A Memory-Based Abstraction Approach to Handle Obfuscation in Polymorphic Virus

摘要: This paper describes a PhD proposal aiming at dealing with obfuscation in polymorphic virus. The major characteristic of virus is the capability infinitely self-modifying when infecting victim programs. It makes traditional signature-based detection technique ineffective since this approach needs to collect all signature instances. A recent emerging counter problem abstracting program from binary level, then extracting an abstracted model for further analysis. most common be extracted perhaps control flow graph (CFG) program. However, control-based abstraction currently suffering some advanced techniques which change not only signatures but also modify significantly Thus, analysis will become quickly too complicated. Hence, we propose novel code based on memory states. allows us detect useless instructions are part code. Moreover, next step, our can extended as new efficient pattern.