Improved call graph comparison using simulated annealing

Proceedings of the ACM Symposium on Applied Computing

Volumn , Issue , 2011, Pages 1516-1523

  Kostakis, Orestis ^a,b   Kinable, Joris ^a,b   Mahmoudi, Hamed ^a   Mustonen, Kimmo ^c  

^a AALTO UNIVERSITY   (Finland)

^b HELSINKI INSTITUTE FOR INFORMATION TECHNOLOGY   (Finland)

^c F Secure Corporation   (Finland)

Author keywords

call graph; graph edit distance; malware; simulated annealing; static analysis

Indexed keywords

ANTI VIRUS; CALL GRAPHS; EXECUTABLES; EXECUTION TIME; GRAPH EDIT DISTANCE; MALWARES; PROBLEM SIZE; SOLUTION QUALITY;

COMPUTATIONAL COMPLEXITY; COMPUTER CRIME; GRAPHIC METHODS; STATIC ANALYSIS; VIRUSES; XML;

SIMULATED ANNEALING;

EID: 79959288642     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1982185.1982509     Document Type: Conference Paper

References (24)

1. U. Bayer, E. Kirda, and C. Kruegel. Improving the efficiency of dynamic malware analysis. In Proceedings of the 2010 ACM Symposium on Applied Computing, pages 1871-1878. ACM, 2010.
2. D. Bilar. Opcodes as predictor for malware. International Journal of Electronic Security and Digital Forensics, 1(2):156-168, 2007.
3. I. Briones and A. Gomez. Graphs, entropy and grid computing: Automatic comparison of malware. In Proceedings of the 2008 Virus Bulletin Conference, 2008.
4. E. Carrera and G. Erd́elyi. Digital genome mapping-advanced binary malware analysis. In Virus Bulletin Conference, 2004.
5. M. Christodorescu and S. Jha. Static analysis of executables to detect malicious patterns. In Proceedings of the 12th USENIX Security Symposium (Security'03), pages 169-186, August 2003.
6. T. Dullien and R. Rolles. Graph-based comparison of executable objects. In Symposium sur la Sécurité des Technologies de l'Information et des Communications (SSTIC), 2005.
7. J. Edmonds and R. M. Karp. Theoretical improvements in algorithmic efficiency for network flow problems. Journal of the ACM, 19(2):248-264, 1972.
8. H. Flake. Structural comparison of executable objects. In Proceedings of the IEEE Conference on Detection of Intrusions, Malware and Vulnerability Assessment (DIMVA), pages 161-173, 2004.
9. M. Fossi, D. Turner, E. Johnson, T. Mack, T. Adams, J. Blackbird, S. Entwise, B. Graveland, D. McKinney, J. Mulcahy, and C. Wueest. Symantec Global Internet Security Threat Report: Trends for 2009, Volume XV, 2010.
10. X. Gao, B. Xiao, D. Tao, and X. Li. A survey of graph edit distance. Pattern Analysis & Applications, 13(1):113-129, 2010.
11. M. R. Garey and D. S. Johnson. Computers and Intractability: A Guide to the Theory of NP-Completeness. W. H. Freeman, January 1979.
12. Hex-rays. The IDA Pro disassembler and debugger. http://www.hex-rays.com/ idapro/.
13. X. Hu, T. Chiueh, and K. G. Shin. Large-scale malware indexing using function-call graphs. In ACM Conference on Computer and Communications Security, pages 611-620. ACM, 2009.
14. D. Justice and A. Hero. A binary linear programming formulation of the graph edit distance. IEEE Transactions on Pattern Analysis and Machine Intelligence, 28:1200-1214, 2006. (Pubitemid 46405019)
15. S. Kirkpatrick, C. Gelatt Jr, and M. Vecchi. Optimization by simulated annealing. Science, 220(4598):671, 1983.
16. J. Z. Kolter and M. A. Maloof. Learning to detect and classify malicious executables in the wild. The Journal of Machine Learning Research, 7, 2006.
17. J. Munkres. Algorithms for the assignment and transportation problems. Journal of the Society for Industrial and Applied Mathematics, 5(1):32-38, 1957.
18. M. Neuhaus, K. Riesen, and H. Bunke. Fast suboptimal algorithms for the computation of graph edit distance. In Structural, Syntactic, and Statistical Pattern Recognition. LNCS, volume 4109/2006, pages 163-172. Springer, 2006.
19. K. Riesen and H. Bunke. Approximate graph edit distance computation by means of bipartite graph matching. Image and Vision Computing, 27(7):950-959, 2009.
20. K. Riesen, M. Neuhaus, and H. Bunke. Bipartite graph matching for computing the edit distance of graphs. In Graph-Based Representations in Pattern Recognition, pages 1-12, 2007.
21. P. van Laarhoven and H. Aarts. Simulated annealing: theory and applications. Mathematics and Its Applications, D. Reidel, Dordrecht, 1987.
22. A. Walenstein, M. Venable, M. Hayes, C. Thompson, and A. Lakhotia. Exploiting similarity between variants to defeat malware. In Proceedings of BlackHat DC 2007, 2007.
23. Z. Zeng, A. K. H. Tung, J. Wang, J. Feng, and L. Zhou. Comparing stars: On approximating graph edit distance. Proceedings of the VLDB Endowment, 2(1):25-36, 2009.
24. S. Zilberstein. Using anytime algorithms in intelligent systems. AI magazine, 17(3):73, 1996.