Platform-Independent Recognition of Procedures in Binaries Based on Simple Characteristics
-
Sebastian Eschweiler
Abstract
Malware analysts are more and more overstrained by today´s flood of malware. Hence, the need for automated tools to assist malware analysis becomes apparent. A common approach of malware analysis is reverse engineering its components, namely (sub-)procedures. We present and evaluate simple procedure characteristics such as the number of instructions for their robustness with respect to different compilers, compilation options and even across operating systems. We identify robust characteristics and apply standard machine learning algorithms based on these characteristics to automatically identify already known procedures in new malware. This prevents analysts from repeatedly reversing known procedures.
Zusammenfassung
Malware-Analysten werden täglich von neuer Malware überflutet, was den Bedarf an automatisierten Werkzeugen deutlich macht. Üblicherweise wird Malware analysiert, indem die Teilkomponenten, also (Unter-)Prozeduren untersucht werden. In der vorliegenden Arbeit werden einfache Prozedur-Charakteristiken wie die Anzahl der Instruktionen vorgestellt und auf ihre Robustheit bezüglich verschiedener Compiler, Compiler-Optionen und sogar betriebssystemübergreifend untersucht. Robuste Charakteristiken werden Standard-Maschinenlernverfahren zugeführt, um automatisiert bereits analysierte Prozeduren in neuer Malware zu erkennen. Hierdurch muss der Analyst die bereits erkannten Prozeduren nicht erneut manuell untersuchen.
© by Oldenbourg Wissenschaftsverlag, Bonn, Germany
Articles in the same Issue
- Reactive Security
- Reverse Code Engineering — State of the Art and Countermeasures
- Platform-Independent Recognition of Procedures in Binaries Based on Simple Characteristics
- Modeling and Describing Misuse Scenarios Using Signature-Nets and Event Description Language
- Anomaly Detection at “supersonic” Speed
- Experiments with P2P Botnet Detection
- Automatic Adaptation of User Interfaces to Cultural Preferences
Articles in the same Issue
- Reactive Security
- Reverse Code Engineering — State of the Art and Countermeasures
- Platform-Independent Recognition of Procedures in Binaries Based on Simple Characteristics
- Modeling and Describing Misuse Scenarios Using Signature-Nets and Event Description Language
- Anomaly Detection at “supersonic” Speed
- Experiments with P2P Botnet Detection
- Automatic Adaptation of User Interfaces to Cultural Preferences
