Academic Journal
Malware lineage in the wild.
| Τίτλος: | Malware lineage in the wild. |
|---|---|
| Συγγραφείς: | Haq, Irfan1 irfanul.haq@imdea.org, Chica, Sergio2 sergio.chica@imdea.org, Caballero, Juan2 juan.caballero@imdea.org, Jha, Somesh3 somesh.jha@cs.wisc.edu |
| Πηγή: | Computers & Security. Sep2018, Vol. 78, p347-363. 17p. |
| Θεματικοί όροι: | *Computer software development, *Open source software, Malware prevention, Disassemblers (Computer programs), Computer software testing |
| Περίληψη: | Abstract Malware lineage studies the evolutionary relationships among malware and has important applications for malware analysis. A persistent limitation of prior malware lineage approaches is to consider every input sample a separate malware version. This is problematic since a majority of malware are packed and the packing process produces many polymorphic variants (i.e., executables with different file hash) of the same malware version. Thus, many samples correspond to the same malware version and it is challenging to identify distinct malware versions from polymorphic variants. This problem does not manifest in prior malware lineage approaches because they work on synthetic malware, malware that are not packed, or packed malware for which unpackers are available. In this work, we propose a novel malware lineage approach that works on malware samples collected in the wild. Given a set of malware executables from the same family, for which no source code is available and which may be packed, our approach produces a lineage graph where nodes are versions of the family and edges describe the relationships between versions. To enable our malware lineage approach, we propose the first technique to identify the versions of a malware family and a scalable code indexing technique for determining shared functions between any pair of input samples. We have evaluated the accuracy of our approach on 13 open-source programs and have applied it to produce lineage graphs for 10 popular malware families. Our malware lineage graphs achieve on average a 26 times reduction from number of input samples to number of versions. [ABSTRACT FROM AUTHOR] |
| Copyright of Computers & Security is the property of Pergamon Press - An Imprint of Elsevier Science and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) | |
| Βάση Δεδομένων: | Business Source Index |
καταχωρήστε σχόλιο πρώτοι!