AGIS: Towards automatic generation of infection signatures

摘要: An important yet largely uncharted problem in malware defense is how to automate generation of infection signatures for detecting compromised systems, i.e., that characterize the behavior residing on a system. To this end, we develop AGIS, host-based technique detects infections by and automatically generates an signature malware. AGIS monitors runtime suspicious code according set security policies detect infection, then identifies its characteristic terms system or API calls. statically analyzes corresponding executables extract instructions infectionpsilas mission. These can be used build template static-analysis-based scanner, regular-expression legacy scanners. also encrypted from plaintext decryption loop. We implemented Windows XP evaluated it against real-life malware, including keyloggers, mass-mailing worms, well-known mutation engine. The experimental results demonstrate effectiveness our new generating high-quality signatures.