A Fast Flowgraph Based Classification System for Packed and Polymorphic Malware on the Endhost

摘要: Identifying malicious software provides great benefit for distributed and networked systems. Traditional real-time malware detection has relied on using signatures string matching. However, ineffectively deal with polymorphic variants. Control flow been proposed as an alternative signature that can be identified across such This paper proposes a novel classification system to detect variants flowgraphs. We propose existing heuristic flowgraph matching algorithm estimate graph isomorphisms. Moreover, we determine similarity between programs by identifying the underlying isomorphic A high query program known identifies variant. To demonstrate effectiveness efficiency of our based classification, compare it alternate algorithms, evaluate real synthetic malware. The evaluation shows accurately detects malware, performs efficiently, is scalable. These performance characteristics enable use intermediary node Email gateway, or end host.