Survey on malware evasion techniques: State of the art and challenges

摘要: Nowadays targeted malware attacks against organizations are increasingly becoming more sophisticated, damaging, and difficult to detect. Current intrusion detection technologies incapable of addressing many the newer evasion techniques such as return-oriented programming remote library injection. This paper presents a survey on various employed in evade by security systems anti-virus software. The we cover include obfuscation, fragmentation session splicing, application specific violations, protocol inserting traffic at IDS, denial service, code reuse attacks. We also discuss mitigations sandboxing, reassembly, data execution prevention, address space layout randomization, control flow integrity, Windows 8 ROP mitigation. compare with an analysis sophistication attack, challenges or difficulty detect, degree impact.