Impeding behavior-based malware analysis via replacement attacks to malware specifications

摘要: As the underground market of malware flourishes, there is an exponential increase in number and diversity malware. A crucial question analysis research how to define specifications or signatures that faithfully describe similar malicious intent also clearly stand out from other programs. Although traditional based on syntactic are efficient, they can be easily defeated by various obfuscation techniques. Since behavior often stable across instances, behavior-based which capture real characteristics during run time, have become more prevalent anti-malware tasks, such as detection clustering. This kind specification typically extracted system call dependence graph a sample invokes. In this paper, we present replacement attacks camouflage behaviors poisoning specifications. The key method our replace its semantically equivalent variants so samples within one family turn different. result, analysts put efforts into reexamining may been investigated before. We distil general attacking strategies mining than 5200 samples’ implement compiler-level prototype automate attacks. Experiments 960 demonstrate effectiveness approach impede similarity comparison end, discuss possible countermeasures order strengthen existing defense.