Detecting virus mutations via dynamic matching

IEEE International Conference on Software Maintenance, ICSM

Volumn , Issue , 2009, Pages 105-114

  Feng, Min ^a   Gupta, Rajiv ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ANTIVIRUS SOFTWARES; DETECTION METHODS; DYNAMIC MATCHING; DYNAMIC SIGNATURE; RUNTIMES; STATIC SIGNATURES; VIRUS DETECTION; VIRUS SIGNATURES;

COMPUTER SOFTWARE; COMPUTER SOFTWARE MAINTENANCE; MICROORGANISMS;

COMPUTER VIRUSES;

EID: 70849114213     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICSM.2009.5306329     Document Type: Conference Paper

References (28)

1. Offensive Computing. http://www.offensivecomputing.net/.
2. VX Heavens. http://vx.netlux.org/.
3. T. Apiwattanapong, A. Orso, and M. J. Harrold. A differencing algorithm for object-oriented programs. ASE'04.
4. F. Bellard. QEMU, a fast and portable dynamic translator. In ATEC'05.
5. D. Bruschi, L. Martignoni, and M. Monga. Code normalization for self-mutating malware. IEEE Security and Privacy, 2007.
6. M. Christodorescu and S. Jha. Static analysis of executables to detect malicious patterns. In USENIX Security Symposium 2003, 2003.
7. M. Christodorescu, S. Jha, S. A. Seshia, D. Song, and R. E. Bryant. Semantics-aware malware detection. In SP'05, 2005.
8. A. Cozzie, F. Stratton, H. Xue, and S. T. King. Digging for data structures. In OSDI 2008.
9. U. Erlingsson and F. B. Schneider. IRM enforcement of Java stack inspection. 2000.
10. H. Flake. Structural comparison of executable objects. In DIMVA'04.
11. D. Jackson and D. A. Ladd. Semantic diff: A tool for summarizing the effects of modifications. In ICSM'94.
12. C. Kruegel, W. Robertson, and G. Vigna. Detecting kernellevel rootkits through binary analysis. ACSAC'04.
13. J. Laski and W. Szermer. Identification of program modifications and its applications in software maintenance. CSM'92.
14. S. Miwa, T. Miyachi, M. Eto, M. Yoshizumi, and Y. Shinoda. Design and implementation of an isolated sandbox with mimetic internet used to analyze malwares. In DETER 2007.
15. E. W. Myers. An o(nd) difference algorithm and its variations. Algorithmica, 1986.
16. C. Nachenberg. Computer virus-antivirus coevolution. Commun. ACM, 1997.
17. V. Nagarajan, R. Gupta, X. Zhang, M. Madou, and B. D. Sutter. Matching control flow of program versions. ICSM'07.
18. S. Person, M. B. Dwyer, S. Elbaum, and C. S. Pasareanu. Differential symbolic execution. In SIGSOFT '08/FSE-16.
19. N. L. Petroni, T. Fraser, J. Molina, and W. A. Arbaugh. Copilot - a coprocessor-based kernel runtime integrity monitor. In USENIX Security Symposium 2003.
20. N. L. Petroni and M. Hicks. Automated detection of persistent kernel control-flow attacks. In CCS'07.
21. T. Reps, T. Ball, M. Das, and J. Larus. The use of program pro-ling for software maintenance with applications to the year 2000 problem. SIGSOFT Softw. Eng. Notes, 1997.
22. K. Rieck, T. Holz, C. Willems, P. Dussel, and P. Laskov. Learning and classification of malware behavior. In DIMVA'08.
23. A. Walenstein, R. Mathur, M. R. Chouchane, and A. Lakhotia. Normalizing metamorphic malware using term rewriting. SCAM'06.
24. N. Wilde. Faster reuse and maintenance using software reconnaissance. Technical Report SERC-TR-75F, SERC, Univ. of Florida, CIS Department, 1994.
25. H. Yin, D. Song, M. Egele, C. Kruegel, and E. Kirda. Panorama: Capturing system-wide information flow for malware detection and analysis. In CCS'07.
26. X. Zhang and R. Gupta. Matching execution histories of program versions. SIGSOFT Softw. Eng. Notes, 2005.
27. X. Zhang and R. Gupta. Whole execution traces and their applications. ACM Trans. Archit. Code Optim., 2005.
28. X. Zhang, R. Gupta, and Y. Zhang. Precise dynamic slicing algorithms. In ICSE'03.