An Automatic Approach to Detect Anti-debugging in Malware Analysis

摘要: Anti-debugging techniques are broadly used by malware authors to prevent security researchers from reversing engineering their created samples. However, the countermeasures identify anti-debugging code patterns insufficient, and mainly manual, which is an expensive, time-consuming, error-prone process. There no automatic approaches can be detect in samples effectively. In this paper, we present approach, based on instruction traces derived dynamic analysis instruction-based pattern matching method, tricks automatically. We evaluate approach with a large number of collected wild. The experience shows that our proposed effective about 40% experimental data set has been embedded code.