BinGraph: Discovering mutant malware using hierarchical semantic signatures

摘要: Malware landscape has been dramatically elevated over the last decade. The main reason of increase is that new malware variants can be produced easily using simple code obfuscation techniques. Once applied, change their syntactics while preserving semantics, and bypass anti-virus (AV) scanners. authors, thus, commonly use techniques to generate metamorphic malware. Nevertheless, signature based AV are limited detect since they on syntactic matching. In this paper, we propose BinGraph, a mechanism accurately discovers BinGraph leverages semantics malware, mutant able manipulate syntax only. To end, first extract API calls from convert hierarchical behavior graph represents with identical 128 nodes semantics. Later, unique subgraphs graphs as semantic signatures representing common behaviors specific family. evaluate analyzed total 827 samples consist 10 families 1,202 benign binaries. Among 20% randomly chosen each family were used for extracting signatures, rest them assessing detection accuracy. Finally, only 32 selected signatures. discovered 98%