Statistical signatures for fast filtering of instruction-substituting metamorphic malware

WORM'07 - Proceedings of the 2007 ACM Workshop on Recurring Malcode

Volumn , Issue , 2007, Pages 31-37

  Chouchane, Mohamed R ^a   Walenstein, Andrew ^a   Lakhotia, Arun ^a  

^a UNIVERSITY OF LOUISIANA AT LAFAYETTE   (United States)

Author keywords

Metamorphic Engine; Virus Scanner

Indexed keywords

CLASSIFICATION METHODS; IN-DEPTH ANALYSIS; INPUT PROGRAMS; MALWARE DETECTION; MALWARES; METAMORPHIC TRANSFORMATIONS; PROGRAM TRANSFORMATIONS; STATISTICAL SIGNATURES; VIRUS SCANNER; VIRUS SCANNERS;

CLASSIFIERS; COMPUTER CRIME; ENGINES; PROBABILITY DISTRIBUTIONS; SCANNING; VIRUSES;

COMPUTER SYSTEM FIREWALLS;

EID: 70349460853     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1314389.1314397     Document Type: Conference Paper

References (17)

1. D. Bilar. Statistical structures: Fingerprinting malware for classification and analysis. In Blak Hat. Black Hat, 2006.
2. D. Bruschi, L. Martignoni, and M. Monga. Using code normalization for fighting self-mutating malware. In Proceedings of International Symposium on Secure Software Engineering. IEEE, March, 2006.
3. M. R. Chouchane and A. Lakhotia. Using engine signature to detect metamorphic malware. In 4th Workshop on Recurring Malcode (WORM), 2006.
4. M. Christodorescu, S. Jha, S. A. Seshia, D. Song, and R. E. Bryant. Semantics-aware malware detection. In Proceedings of the 2005 IEEE Symposium on Security and Privacy (S&P'05), pages 32-46, 2005.
5. M. Christodorescu, J. Kinder, S. Jha, S. Katzenbeisser, and H. Veith. Malware normalization. Technical report, Department of Computer Science, The University of Wisconsin, 2005.
6. T. Fawcett. ROC graphs: Notes and practical considerations for researchers. Technical report, HP Laboratories, Palo Alto, U.S.A., Jan. 2003.
7. I. Krsul and E. Spafford. Authorship analysis: Identifying the author of a program. Computers and Security, 16(3):233-257, 1997.
8. C. Kruegel, E. Kirda, D. Mutz,W. Robertson, and G. Vigna. Polymorphic worm detection using structural information of executables. In Proceedings of the 8th Symposium on Recent Advances in Intrusion Detection (RAID'2005), Lecture Notes in Computer Science. Springer-Verlag, 2005.
9. A. Lakhotia, A. Kapoor, and E. U. Kumar. Are metamorphic viruses really invincible? - partI. Virus Bulletin, pages 5-7, December 2004 2004.
10. A. Lakhotia and M. Mohammed. Imposing order on program statements to assist anti-virus scanners. In Proceedings of the 11th Working Conferenceon Reverse Engineering, 2004.
11. A. Lakhotia and P. K. Singh. Challenges in getting 'formal' with viruses. Virus Bulletin, pages 15-19, September 2003 2003.
12. R. Mathur. Normalizing metamorphic malware using term-rewriting. Master's thesis, Center for Advanced Computer Studies, University of Louisiana at Lafayette, Dec. 2006.
13. S. J. Stolfo, K. Wang, and W.-J. Li. Towards stealthy malware detection. In Malware Detection, volume 27 of Advances in Information Security. Springer, 2007.
14. P. Ször. The Art of Computer Virus Research and Defense. Symantec Press. Addison Wesley Professional, 1st edition, 2005.
15. VX heavens. vx.netlux.org.
16. A. Walenstein, R. Mathur, M. R. Chouchane, and A. Lakhotia. Normalizing metamorphic malware using term-rewriting. In 6th IEEE International Workshop on Source Code Analysis and Manipulation (SCAM), 2006.
17. A. Walenstein, R. Mathur, M. R. Chouchane, and A. Lakhotia. The design space of metamorphic malware. In 2nd International Conference on i-Warfare and Security (ICIW), 2007.