SBE '—' A Precise Shellcode Detection Engine Based on Emulation and Support Vector Machine

摘要: An important method of detecting zero-day attacks is to identify the shellcode which usually taken as part attacks. However, detection range always restricted, for existent emulation based techniques only take several features that are observed when emulated. In this paper, we propose a new algorithm on and Support Vector Machine(SVM). One most prominent advantages by means emulating, can get real executed path includes key e.g. loop, xor, GetPC etc. Moreover, recording aforementioned training them with SVM, rely general detect rather than specific features. addition, build complete data set so other researchers focus algorithms. We have implemented prototype system named SBE Ubuntu/Amd-64 tested our various kinds shellcode. Experiment shows proposed has better rate Libemu could effectively all x86 very few false positives.