Imposing order on program statements to assist anti-virus scanners

Proceedings - Working Conference on Reverse Engineering, WCRE

Volumn , Issue , 2004, Pages 161-170

  Lakhotia, Arun ^a   Mohammed, Moinuddin ^a  

^a UNIVERSITY OF LOUISIANA AT LAFAYETTE   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ANTI-VIRUS (AV); BLOODHOUND TECHNOLOGY; CODE NORMALIZATION; MORPHING TRANSFORMATIONS;

ALGORITHMS; C (PROGRAMMING LANGUAGE); EXPERT SYSTEMS; FEATURE EXTRACTION; INFORMATION RETRIEVAL; SCANNING; SEMANTICS;

COMPUTER VIRUSES;

EID: 18144364355     PISSN: 10951350     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (19)

1. A. Aho, R. Sethi, and J. Ullman, Compilers Principles, Techniques, and Tools: Addison-Wesley, 1986.
2. V. Bontchev, "Macro and Script Virus Polymorphism," in Proceedings of the 12th International Virus Bulletin Conference, 2002.
3. M. Christodrescu and S. Jha, "Static Analysis of Executables to Detect Malicious Patterns," in The 12th USENIX Security Symposium (Security '03), Washington DC, USA, 2003.
4. F. Cohen, "Computer Viruses-Theory and Experiments," Computers and Security, 6, 1984
5. C. Collberg and C. Thomborson, "Watermarking, Tamper-Proofing, and Obfuscation - Tools for Software Protection," IEEE Transactions on Software Engineering, vol. 28, pp. 735-746, 2002.
6. C. G. Davis, "Debian Cook Package," http://packages.debian.org/ stable/devel/cook.html, Last accessed 08/29/2003.
7. J. Ferrante, K. J. Ottenstein, and J. Warren, "The Program Dependence Graphs and Its Use in Optimization," ACM Transactions on Programming Languages and Systems (TOPLAS), vol. 9, pp. 319-349, 1987.
8. GrammaTech, "Codesurfer - Program Analysis Tool," http://www.codesurfer.com, Last accessed 08/29/2003.
9. R. Komondoor and S. Horwitz, "Using Slicing to Identify Duplication in Source Code," in Proceedings of the 8th International Symposium on Static Analysis, Paris, France, 2001.
10. A. Lakhotia and P. K. Singh, "Challenges in Getting Formal with Viruses," Virus Bulletin, 2003, http://www.virusbtn.com/magazine/archives/ 200309/formal.xml.
11. C. Linn and S. Debray, "Obfuscation of Executable Code to Improve Resistance to Static Disassembly," in Proceedings of the 10th ACM Conference on Computer and Communication Security 2003, Washington D.C., USA, 2003.
12. R. W. Lo, K. N. Levitt, and R. A. Olsson, "MCF: A Malicious Code Filter," Computers & Security, vol. 14, pp. 541-566, 1995.
13. M. Mohammed, Zeroing in on Metamorpic Computer Viruses, Center for Advanced Computer Studies, University of Louisiana at Lafayette, M.S. Thesis, 2003.
14. R. M. Stallman, R. McGrath, and P. Smith, "GNU Make, a Program for Directing Recompilation," 2002.
15. R. T. Stevens, Fractal Programming in C: John Wiley and Sons, 1989.
16. Symantec, "Understanding Heuristics: Symantec's Bloodhound Technology," http://www.symantec.com/avcenter/reference/heuristc.pdf, Last accessed July 1, 2004.
17. G. Szappanos, "Are There Any Polymorphic Macro Viruses at All? (... and What to Do with Them)," in Proceedings of the 12th International Virus Bulletin Conference, 2002.
18. P. Ször and P. Ferrie, "Hunting for Metamorphic," in Proceedings of the 11th International Virus Bulletin Conference, 2001.
19. G. Wroblewski, General Method of Program Code Obfuscation, Institute of Engineering Cybernetics, Wroclaw University of Technology, PhD. Thesis, 2002.