Code normalization for self-mutating malware

IEEE Security and Privacy

Volumn 5, Issue 2, 2007, Pages 46-54

  Bruschi, Danilo ^a   Martignoni, Lorenzo ^a   Monga, Mattia ^a  

^a UNIVERSITY OF MILAN   (Italy)

Author keywords

[No Author keywords available]

Indexed keywords

CODE NORMALIZATION; MALWARE SIGNATURES; SELF-MUTATING CODES; SELF-MUTATING MALWARE;

CODES (SYMBOLS); GRAPH THEORY; PATTERN RECOGNITION; PROGRAM DEBUGGING; RANDOM PROCESSES;

SOFTWARE ENGINEERING;

EID: 34047180006     PISSN: 15407993     EISSN: None     Source Type: Journal    
DOI: 10.1109/MSP.2007.31     Document Type: Review

References (18)

1. P. Ször and P. Ferrie, "Hunting for Metamorphic," Proc. Virus Bulletin Conf., Virus Bulletin, 2001, pp. 123-144.
2. M. Christodorescu and S. Jha, "Testing Malware Detectors," Proc. 2004 ACM SIGSOFT Int'l Symp. Software Testing and Analysis (ISSTA 04), ACM Press, 2004, pp. 34-44.
3. M. Christodorescu and S. Jha, "Static Analysis of Executables to Detect Malicious Patterns," Proc. Usenix Security Symposium, Usenix Assoc., 2003, pp. 169-186.
4. D.M. Chess and S.P. White, "An Undetectable Computer Virus," Proc. Virus Bulletin Conf., Virus Bulletin, 2000; www.research.ibm.com/ antivirus/SciPapers/VB2000DC.htm.
5. F.B. Cohen, A Short Course on Computer Viruses, 2nd ed., Wiley, 1994.
6. C. Collberg, C. Thomborson, and D Low, A Taxonomy of Obfuscating Transformations, tech. report 148, Dept. of Computer Science, Univ. of Auckland, July 1997.
7. P. Ször, The Art of Computer Virus Research and Defense, Addison-Wesley, 2005.
8. A. Lakhotia, A. Kapoor, and E.U. Kumar, "Are Metamorphic Viruses Really Invincible?" Virus Bulletin, Dec. 2004, pp. 5-7.
9. S.K. Debray et al., "Compiler Techniques for Code Compaction," ACM Trans. Programming Languages and Systems, vol. 22, no. 2, 2000, pp. 378-415.
10. S.S. Muchnick, Advanced Compiler Design and Implementation, Morgan Kaufmann, 1997.
11. A.V Aho, R. Sethi, and J.D Ullman, Compilers: Principles, Techniques and Tools, Addison-Wesley, 1986.
12. J.R. Ullman, "An Algorithm for Subgraph Isomorphism," J. ACM, vol. 23, no. 1, 1976, pp. 31-42.
13. C. Kruegel et al., "Polymorphic Worm Detection using Structural Information of Executables," Proc. Int'l Symp. Recent Advances in Intrusion Detcaion, Springer, 2005, pp. 207-226.
14. C. Cifuentes and S. Sendall, "Specifying the Semantics of Machine Instructions," Proc. 6th Int'l Workshop on Program Comprehension (IWPC 98), IEEE CS Press, 1998, pp. 126-133.
15. C. Cifuentes and M.V. Emmerik, "Recovery of Jump Table Case Statements from Binary Code," Proc. 7th Int'l Workshop on Program Comprehension, IEEE CS Press, 2001, pp. 171-188.
16. D. Bruschi, L. Martignoni, and M. Monga, "Using Code Normalization for Fighting Self-Mutating Malware," Proc. Int'l Symp. Secure Software Engineering, IEEE CS Press, 2006, pp. 37-44.
17. L.P. Cordella et al., "A (Sub)graph Isomorphism Algorithm for Matching Large Graphs," IEEE Trans. Pattern Analysis and Machine Intelligence, vol. 26, no. 10, 2004, pp. 1367-1372.
18. D. Bruschi, L. Martignoni, and M. Monga, "Detecting Self-Mutating Malware Using Control Flow Graph Matching," Proc. Conf. Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA), Springer, 2005, pp. 129-143.