Mining Malware Specifications through Static Reachability Analysis

摘要: The number of malicious software (malware) is growing out control. Syntactic signature based detection cannot cope with such growth and manual construction malware databases needs to be replaced by computer learning approaches. Currently, a single modern capturing the semantics behavior can used replace an arbitrarily large old-fashioned syntactical signatures. However teaching computers learn behaviors challenge. Existing work relies on dynamic analysis extract behaviors, but technique does not guarantee coverage all behaviors. To sidestep this limitation we show how signatures using static reachability analysis. idea model binary programs pushdown systems (that stack operations occurring during code execution), use in form trees, subtrees that are common among trees extracted from training set files as detect propose tree automaton compactly store check if any file under malicious. Experimental data shows our approach them test 10 times size set.