Automatic Malware Signature Generation

摘要: The times when malware researchers could spend weeks analyzing a new piece of are long gone. Today newmalicious programs written and distributed at such speed that it just is not possible. Virus scanners the most common countermeasure against attacks they need up-to-date signatures to successfully identify malware. This thesis describes Autosig, program for automatic generation signatures. based on fact come in many different variants, but still share some invariant code. Using statistical data how often certain byte combinations appear legitimate files, Autosig extracts substring from this code generate signature. tested those fail pass all tests discarded. By remembering discarded signatures, learns which avoid. technique has turned out be successful time consuming routine cases, leaving human analysts more working complicated It also helpful replacing overlapping redundant leading smaller signature database.