Defining malware families based on analyst insights

2011 IEEE International Conference on Technologies for Homeland Security, HST 2011

Volumn , Issue , 2011, Pages 396-401

  Gennari, Jeff ^a   French, David ^a  

^a CARNEGIE MELLON UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ANALYTIC METHOD; ANTI VIRUS; BLIND CLASSIFICATION; BLOOM FILTERS; COMPLEX PROCESSES; CYBER-ATTACKS; HOST-BASED; MALICIOUS CODES; MALICIOUS-CODE ANALYSIS; MALWARES; OBJECTIVE CRITERIA; ROADMAP; SIGNATURE GENERATION; SIMILARITY MEASUREMENTS; STRUCTURAL INFORMATION;

CODES (SYMBOLS); FUZZY FILTERS; NETWORK SECURITY; SECURITY SYSTEMS; SEMANTICS;

COMPUTER CRIME;

EID: 84855800908     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/THS.2011.6107902     Document Type: Conference Paper

References (21)

1. M. Schmall, "Heuristic techniques in av solutions: An overview," February 2002. [Online]. Available: http://www.symantec.com/ connect/articles/heuristic-techniques-avsolutions-overview
2. M. Bailey, J. Oberheide, J. Andersen, Z. M. Mao, F. Jahanian, and J. Nazario, "Automated classification and analysis of internet malware," in RAID, ser. Lecture Notes in Computer Science, C. Krügel, R. Lippmann, and A. Clark, Eds., vol. 4637. Springer, 2007, pp. 178-197.
3. K. Timm, "The effectiveness of antivirus on new malware samples," December 2008. [Online]. Available: http://blogs.cisco.com/ security/the-effectiveness-of-antivirus-on-new-malware-samples
4. J. Jang, D. Brumley, and S. Venkataraman, "Bitshred: Fast, scalable malware triage," Cylab, Carnegie Mellon University, Pittsburgh, PA, Technical Report CMU-Cylab-10-022, May 2010.
5. J. D. Kornblum, "Identifying almost identical files using context triggered piecewise hashing," Digital Investigation, vol. 3, no. Supplement-1, pp. 91-97, 2006.
6. D. Ninja, "Fuzzy clarity: Using fuzzy hashing techniques to identify malicious code," April 2007. [Online]. Available: http://www. digitalninjitsu.com/downloads/Fuzzy-Clarity-rev1.pdf
7. E. Carerra and G. Erdélyi, "Digital genome mapping - advanced binary malware analysis," pp. 323-334, 2004.
8. X. Hu, T. Chiueh, and K. G. Shin, "Large-scale malware indexing using function-call graphs," in Computer and Communications Security, 2009, pp. 611-620.
9. J. Kinable and O. Kostakis, "Malware classification based on call graph clustering," CoRR, vol. abs/1008.4365, 2010.
10. P. Trinius, C. Willems, T. Holz, and K. Rieck, "A malware instruction set for behavior-based analysis," in Sicherheit, ser. LNI, F. C. Freiling, Ed., vol. 170. GI, 2010, pp. 205-216.
11. K. Rieck, P. Trinius, C. Willems, and T. Holz, "Automatic analysis of malware behavior using machine learning," Journal of Computer Security, vol. 19, no. 3, 2011.
12. P. Li, L. Liu, D. Gao, and M. K. Reiter, "On challenges in evaluating malware clustering," in RAID, ser. Lecture Notes in Computer Science, S. Jha, R. Sommer, and C. Kreibich, Eds., vol. 6307. Springer, 2010, pp. 238-255.
13. M. Christodorescu and S. Jha, "Static analysis of executables to detect malicious patterns," in Proceedings of the 12th USENIX Security Symposium (Security'03), USENIX Association. USENIX Association, Aug. 2003, pp. 169-186.
14. A. Walenstein, M. Venable, M. Hayes, C. Thompson, and A. Lakhotia, "Exploiting similarity between variants to defeat malware," in Proceedings of BlackHat 2007 DC Briefings, 2007.
15. P. Szor, The Art of Computer Virus Research and Defense. Addison-Wesley Professional, 2005.
16. V. Alvarez, "The yara project." [Online]. Available: http://code.google.com/p/yara-project
17. -, "Rule-driven malware identification and classification," January 2008. [Online]. Available: http://www.virusbtn.com/virusbulletin/ archive/2008/01/vb200801-rule-driven-classification
18. J. D. Kornblum, "Fuzzy hashing and ssdeep." [Online]. Available: http://ssdeep.sourceforge.net
19. K. Coogan, S. Debray, T. Kaochar, and G. Townsend, "Automatic static unpacking of malware binaries," in Proceedings of the 2009 16th Working Conference on Reverse Engineering, ser. WCRE '09. Washington, DC, USA: IEEE Computer Society, 2009, pp. 167-176. [Online]. Available: http://dx.doi.org/10. 1109/WCRE.2009.24
20. D. Quist, "Exploiting similarity between variants to defeat malware," in Proceedings of BlackHat USA 2007, July 2007.
21. L. Böhne, "Pandora's bochs: Automatic unpacking of malware," Diploma Thesis, University of Mannheim, January 2008.