Improving the efficiency of dynamic malware analysis

Proceedings of the ACM Symposium on Applied Computing

Volumn , Issue , 2010, Pages 1871-1878

  Bayer, Ulrich ^a   Kirda, Engin ^b   Kruegel, Christopher ^c  

^a VIENNA UNIVERSITY OF TECHNOLOGY   (Austria)

^b EURECOM   (France)

^c UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

dynamic analysis; malware analysis

Indexed keywords

ANALYSIS SYSTEM; ANALYSIS TIME; CONTROLLED ENVIRONMENT; EXECUTABLE FILES; HARDWARE COST; MALWARE ANALYSIS; MALWARES; PROTOTYPE IMPLEMENTATIONS; SECURITY COMPANY;

COMPUTER CRIME; COST REDUCTION; SOFTWARE PROTOTYPING;

DYNAMIC ANALYSIS;

EID: 77954701461     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1774088.1774484     Document Type: Conference Paper

References (26)

1. ANUBIS. http://anubis.iseclab.org, 2009.
2. Article about Pinch in the Washington Post. http://blog.washingtonpost. com/securityfix/ 2007/11/new-malware-defeats-sitekey-te.html? nav=rss-blog, 2009.
3. Boost.Python C++ library. http://www.boost.org, 2009.
4. CWSandbox. http://www.cwsandbox.org/, 2009.
5. Description of Allaple by F-Secure. http: //www.f-secure.com/v-descs/ allaple-a.shtml, 2009.
6. Description of Trojan-PWS.Win32.LdPinch by Mcafee. http://vil.nai.com/ vil/content/v-100539.htm, 2009.
7. Description of Virus.Win32.Virut by F-Secure. http://www.f-secure.com/v- descs/virus-w32- virut.shtml, 2009.
8. JoeBox. http://www.joebox.org, 2009.
9. Norman Sandbox. http://www.norman.com/microsites/nsic/, 2009.
10. ThreatExpert. http://www.threatexpert.com/, 2009.
11. M. Bailey, J. Oberheide, J. Andersen, Z. M. Mao, F. Jahanian, and J. Nazario. Automated classification and analysis of internet malware. In Proceedings of the 10th International Symposium on Recent Advances in Intrusion Detection (RAID'07), September 2007.
12. U. Bayer, C. Kruegel, and E. Kirda. TTAnalyze: A Tool for Analyzing Malware. In 15th European Institute for Computer Antivirus Research (EICAR 2006) Annual Conference, April 2006.
13. U. Bayer, P. Milani Comparetti, C. Hlauschek, C. Kruegel, and E. Kirda. Scalable, Behavior-Based Malware Clustering. In Symposium on Network and Distributed System Security (NDSS), 2009.
14. A. Z. Broder, S. C. Glassman, M. S. Manasse, and G. Zweig. Syntactic clustering of the web. Comput. Netw. ISDN Syst., 29(8-13):1157-1166, 1997.
15. M. Christodorescu and S. Jha. Static Analysis of Executables to Detect Malicious Patterns. In Usenix Security Symposium, 2003.
16. M. Christodorescu, S. Jha, S. Seshia, D. Song, and R. Bryant. Semantics-Aware Malware Detection. In IEEE Symposium on Security and Privacy, 2005.
17. T. Dullien and R. Rolles. Graph-based comparison of Executable Objects. In In Symposium sur la Sécurité des Technologies de l'Information et des Communications (SSTIC), June 2005.
18. F. Guo, P. Ferrie, and T.-C. Chiueh. A study of the packer problem and its solutions. In RAID '08: Proceedings of the 11th international symposium on Recent Advances in Intrusion Detection, pages 98-115, Berlin, Heidelberg, 2008. Springer-Verlag.
19. T. H. Haveliwala, A. Gionis, and P. Indyk. Scalable techniques for clustering the web. In WebDB (Informal Proceedings), pages 129-134, 2000.
20. P. Indyk and R. Motwani. Approximate nearest neighbors: towards removing the curse of dimensionality. In Proc. of 30th STOC, pages 604-613, 1998.
21. P. Jaccard. The Distribution of Flora in the Alpine Zone. The New Phytologist, 11(2):37-50, 1912.
22. C. Kruegel, W. Robertson, and G. Vigna. Detecting Kernel-Level Rootkits Through Binary Analysis. In Annual Computer Security Application Conference (ACSAC), 2004.
23. T. Lee and J. J. Mody. Behavioral Classification. In EICAR Conference, 2006.
24. C. Linn and S. Debray. Obfuscation of executable code to improve resistance to static disassembly. In CCS '03: Proceedings of the 10th ACM conference on Computer and communications security, pages 290-299, New York, NY, USA, 2003. ACM.
25. A. Moser, C. Kruegel, and E. Kirda. Limits of Static Analysis for Malware Detection. In ACSAC, pages 421-430. IEEE Computer Society, 2007.
26. T. Yetiser. Polymorphic Viruses - Implementation, Detection, and Protection. http://vx.netlux.org/lib/ayt01.html, 1993.