Fileprint analysis for Malware Detection 1

摘要: Malcode can be easily hidden in document files and embedded application executables. We demonstrate this opportunity of stealthy malcode insertion several experiments using a standard COTS Anti-Virus (AV) scanner. In the case zero-day malicious exploit code, signature-based AV scanners would fail to detect such even if scanner knew where look. propose use statistical binary content analysis order suspicious anomalous file segments that may suggest infection by malcode. Experiments are performed determine whether approach n-gram provide useful evidence an infected subsequently subjected further scrutiny. Our goal is develop efficient means detecting suspect for online network communication or scanning large store collected information, as data warehouse shared documents. 1. Introduction Attackers have used variety ways embedding code otherwise normal appearing infect systems. Viruses attach themselves system files, media nothing new. State-of-the-art products scan apply signature these known malware. For various performance optimization reasons, however, not perform deep all malcodes been arbitrary location. Other stealth avoid detection well known. Various self-encryption obfuscation techniques simply making unavailable inspection new “zero day” had access paper we explore sharing streaming, acquired content. The first contribution astonishing observation anti-virus systems deceived given our experiments, inserted into PDF DOC files. Although captured they appear stand alone quite few poisoned carrying inside were flagged popular Furthermore, some successfully opened Adobe Word. Thus, formats logic provides ready made stealthily infecting host with innocent This implies sandboxing their execution effective detectors cases. also note existing vulnerability certain windows executables [23] remains available malware while avoiding detection. simple block padding portion MS WINWORD.EXE creating operates correctly original executable.