Classification of malware using structured control flow

摘要: Malware is a pervasive problem in distributed computer and network systems. Identification of malware variants provides great benefit early detection. Control flow has been proposed as characteristic that can be identified across variants, resulting flowgraph based classification. Static analysis widely used for the classification but ineffective if undergoes code packing transformation to hide its real content. This paper proposes novel algorithm constructing control graph signature using decompilation technique structuring. Similarity between structured graphs quickly determined string edit distances. To reverse transformation, fast application level emulator proposed. demonstrate effectiveness automated unpacking classification, we implement complete system evaluate it synthetic malware. The evaluation shows our highly effective terms accuracy revealing all hidden code, execution time unpacking,