Callgraph properties of executables

AI Communications

Volumn 20, Issue 4, 2007, Pages 231-243

  Bilar, Daniel ^a  

^a WELLESLEY COLLEGE   (United States)

Author keywords

Callgraph; Executables; Graph structural fingerprint; HOT (highly optimized tolerance) process; Malware; Optimization

Indexed keywords

MATHEMATICAL MODELS; OPTIMIZATION; PROBABILITY DISTRIBUTIONS; SUPERVISORY AND EXECUTIVE PROGRAMS;

EXECUTABLES; GRAPH-STRUCTURAL FINGERPRINTS; HIGHLY OPTIMIZED TOLERANCE (HOT) PROCESS; MALWARES;

GRAPH THEORY;

EID: 36048998472     PISSN: 09217126     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Conference Paper

References (46)

1. L. Adamic and B. Huberman, Zipf's law and the internet, Glottometrics 3 (2002), 143-150.
2. A.L. Barabasi, Mean field theory for scale-free random networks, Physica A: Statistical Mechanics and its Applications 272 (1999), 173-187; cond-mat/9907068.
3. E. Carerra, Introduction to IDAPython, http://dkbza.org/data/ IntroductionstoIDAPython.pdf, 2005; accessed December 30th, 2006.
4. J.M. Carlson and J. Doyle, Highly optimized tolerance: A mechanism for power laws in designed systems, Physical Review E 60(2) (1999), 1412-1428.
5. J.M. Carlson and J. Doyle, Complexity and robustness, Proceedings of the National Academy of Sciences 99(Suppl. 1) (2002), 2538-2545.
6. A. Chatzigeorgiou, N. Tsantalis and G. Stephanides, Application of graph theory to OO software engineering, in: WISER'06: Proceedings of the 2006 International Workshop on Workshop on Interdisciplinary Software Engineering Research, New York, NY, USA, ACM Press, 2006, pp. 29-36.
7. M. Christodorescu and S. Jha, Static analysis of executables to detect malicious patterns, in: Security'03: Proceedings of the 12th USENIX Security Symposium, USENIX Association, August 2003, pp. 169-186.
8. A. Clementi, Anti-virus comparative no. 11, Technical report, Kompetenzzentrum IT, Insbruck (Austria), August 2006; http://www.av- comparatives.org/seiten/ergebnisse/report11.pdf.
9. G. Concas, M. Marchesi, S. Pinna and N. Serra, On the suitability of Yule process to stochastically model some properties of object-oriented systems, Physica A: Statistical Mechanics and its Applications 370 (2006), 817-831.
10. T. Dullien, Binnavi v1.2, http://www.sabre-security.com/products/binnavi. html, 2006.
11. T. Dullien and R. Rolles, Graph-based comparison of executable objects, in: SSTIC05: Symposium sur la sécurité des technologies de l'information et des communications, Rennes, France, June 2005.
12. Z. Fan, Estimation problems for distributions with heavy tails, PhD thesis, Georg-August-Universität zu Göttingen, 2001.
13. H. Flake, Compare, Port, Navigate, Black Hat Europe 2005 Briefings and Training, March 2005.
14. C.W. Fraser and D.R. Hanson, A Retargetable C Compiler: Design and Implementation, Addison-Wesley, Longman Publishing Co., Inc., Boston, MA, 1995.
15. E. Gamma, R. Helm, R. Johnson and J. Vlissides, Design patterns: Abstraction and reuse of object-oriented design, Lecture Notes in Computer Science 707 (1993), 406-431.
16. M.L. Goldstein, S.A. Morris and G.G. Yen, Problems with fitting to the power-law distribution, European Journal of Physics B 41(2) (2004), 255-258; cond-mat/0402322.
17. I. Guilfanov, Fast library identification and recognition technology, http://www.datarescue.com/idabase/flirt.htm, 1997.
18. I. Guilfanov, Ida pro v5.0.0.879, http://www.datarescue.com/idabase/, 2006.
19. M. Haneda, P.M.W Knijnenburg and H.A.G. Wijshoff, Optimizing general purpose compiler optimization, in: CF'05: Proceedings of the 2nd Conference on Computing Frontiers, ACM Press, New York, NY, USA, 2005, pp. 180-188.
20. hermit, VX Heaven, http://vx.netlux.org/, 2007.
21. C. Krügel, E. Kirda, D. Mutz, W. Robertson and G. Vigna, Polymorphic worm detection using structural information of executables, in: Recent Advances in Intrusion Detection, A. Valdes and D. Zamboni, eds, Lecture Notes in Computer Science, Vol. 3858, Springer, 2005, pp. 207-226.
22. K. Labs, Backdoor.win32.livup.c, http://www.viruslist.com/en/viruses/ encyclopedia?virusid=44936, 2005; accessed August 1st, 2007.
23. J. Lakos, Large-Scale C++ Software Design, Addison Wesley Longman Publishing Co., Inc., Redwood City, CA, USA, 1996.
24. E. Limpert, W.A. Stahel and M. Abbt, Log-normal distributions across the sciences: Keys and clues, Bio-Science 51(5) (2001), 341-352.
25. B.P. Miller, G. Cooksey and F. Moore, An empirical study of the robustness of MacOS applications using random testing, in: RT'06: Proceedings of the 1st International Workshop on Random Testing, New York, NY, USA, ACM Press, 2006, pp. 46-54.
26. B.P. Miller, L. Fredriksen and B. So, An empirical study of the reliability of Unix utilities, Communication of the ACM 33(12) (1990), 32-44.
27. M. Mitzenmacher, Dynamic models for file sizes and double Pareto distributions, Internet Mathematics 1(3) (2004), 305-334.
28. S.S. Muchnick, Advanced Compiler Design and Implementation, Morgan Kaufmann Publishers, Inc., San Francisco, CA, 1998.
29. C. Myers, Software systems as complex networks: Structure, function, and evolvability of software collaboration graphs, Physical Review E (Statistical, Nonlinear, and Soft Matter Physics) 68(4) (2003), 046116.
30. M. Newman, Power laws, Pareto distributions and Zipf's law, Contemporary Physics 46(5) (2005), 323-351.
31. M. Newman, A.-L. Barabasi and D.J. Watts, The Structure and Dynamics of Networks, Princeton Studies in Complexity, Princeton University Press, Princeton, NJ, 2006.
32. M.E.J. Newman, The structure and function of complex networks, SIAM Review 45 (2003), 167-256.
33. M. Oberhumer, L. Molnr and J.F. Reiser, UPX - ultimate packer for executables, http://upx.sourceforge.net/, 2006.
34. A. Potanin, J. Noble, M. Frean and R. Biddle, Scale-free geometry in OO programs, Communication of the ACM 48(5) (2005), 99-103.
35. S. Resnick, Heavy tail modeling and teletraffic data, Annals of Statistics 25(5) (1997), 1805-1869.
36. E. Skoudis and L. Zeltser, Malware: Fighting Malicious Code, Prentice Hall, Upper Saddle River, NJ, 2003.
37. Snaker, PEiD v0.94, http://peid.has.it/, 2006.
38. P. Szor, The Art of Computer Virus Research and Defense, in: [39], 2005, pp. 252-293.
39. P. Szor, The Art of Computer Virus Research and Defense, Addison-Wesley Professional, Upper Saddle River, NJ, 2005.
40. P. Szor and P. Ferrie, Hunting for metamorphic, in: VB'01: Proceedings of the 11th Virus Bulletin Conference, September 2001.
41. G. Udny Yule, A mathematical theory of evolution, based on the conclusions of Dr. J.C Willis, F.R.S., Royal Society of London Philosophical Transactions Series B 213 (1925), 21-87.
42. S. Valverde, R. Ferrer Cancho and R.V. Solé, Scale-free networks from optimal design, Europhysics Letters 60 (2002), 512-517; cond-mat/0204344.
43. S. Valverde and R.V. Solé, Logarithmic growth dynamics in software networks, Europhysics Letters 72 (2005), 5-12; physics/0511064.
44. J. Whittaker and H. Thompson, How to Break Software Security, Addison Wesley (Pearson Education), June 2003.
45. W. Willinger, D. Alderson, J.C. Doyle and L. Li, More normal than normal: scaling distributions and complex systems, in: WSC'04: Proceedings of the 36th Conference on Winter Simulation, Winter Simulation Conference, 2004, pp. 130-141.
46. G.T. Wu, S.L. Twomey and R.E. Thiers, Statistical evaluation of method-comparison data, Clinical Chemistry 21(3) (1975), 315-320.