A heuristic approach for detection of obfuscated malware

2009 IEEE International Conference on Intelligence and Security Informatics, ISI 2009

Volumn , Issue , 2009, Pages 291-299

  Treadwell, Scott ^a   Mian, Zhou ^a  

^a Bank of America   (United States)

Author keywords

Detection; Heuristic; Malware; Obfuscated; PE header

Indexed keywords

DETECTION; HEURISTIC; MALWARE; OBFUSCATED; PE HEADER;

HEURISTIC METHODS; INTERSYMBOL INTERFERENCE;

COMPUTER VIRUSES;

EID: 70350057168     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ISI.2009.5137328     Document Type: Conference Paper

References (16)

1. Craig, Paul. "Unpacking Malware, Trojans, and Worms: PE Packers Used in Malicious Software." Ruxcon 2006. http://www.slideshare.net/amiable- indian/pe-packers-used-in-malicious-software-part-1/ (2006)
2. Microsoft Corporation. "Microsoft Portable Executable and Common Object File Format Specification." http://www.microsoft.com/whdc/system/ platform/firmware/PECOFF.mspx
3. Szor, Peter. "The Art of Computer Virus Research and Defense." Addison Wesley, (2005)
4. PeiD packer signature, http://peid.has.it/
5. Virus Total online suspicious file analysis, http://www.virustotal.com/
6. Red Curtain. http://www.mandiant.com
7. Q. Zhang, D. S. Reeves, P, Ning, S. P. Lyer, "Analyzing network traffic to detect self-decryting exploit code" ASIACCS', ACM (2007)
8. th WCRE (2005)
9. th ACSAC' (2004)
10. th ACM SIGPLAN-SIGACT symposium on POPL (2007)
11. R. Lyda, J. H. Mcdonald, "Using Entropy Analysis to Find Encrypted and Packed Malware", IEEE Security and Privacy, (2007)
12. A. Lakhotia, E. U. Kumar, M. Vennable, "A Method for Detecting Obfuscated Calls in Malicious Binaries", IEEE transactions on Software Engineering, Vol 31, No 11, November (2006)
13. Norman, Hhttp://www.norman.comH
14. VMWare, Hhttp://www.vmware.comH
15. Ollydbg, Hhttp://www.ollydbg.deH
16. Windbg, http://www.microsoft.com