Options
Control Flow Change in Assembly as a Classifier in Malware Analysis
Author(s)
Date Issued
2016-04-27
Date Available
2016-05-17T14:49:04Z
Abstract
As currently classical malware detection methods based on signatures fail to detect new malware, they are not always efficient with new obfuscation techniques. Besides, new malware is easily created and old malware can be recoded to produce new one. Therefore, classical Antivirus becomes consistently less effective in dealing with those new threats. Also malware gets hand tailored to bypass network security and Antivirus. But as analysts do not have enough time to dissect suspected malware by hand, automated approaches have been developed. To cope with the mass of new malware, statistical and machine learning methods proved to be a good approach classifying programs, especially when using multiple approaches together to provide a l ikelihood of software b e ing malicious. In normal approach, some steps have been taken, mostly by analyzing the opcodes or mnemonics of disassembly and their distribution. In this paper, we focus on the control flow change (CFC) itself and finding out if it is significant to detect malware. In the scope of this work, only relative control flow changes are contemplated, as these are easier to extract from the first chosen disassembler library and are within a range of 256 addresses. These features are analyze d as a raw feature, as n-grams of length 2, 4 and 6 and the even more abstract feature of the occurrences of the n-grams is used. Statistical methods were used as well as the Naïve-Bayes algorithm to find out if there is significant data in CFC. We also test our approach with real-world datasets.
Type of Material
Conference Publication
Publisher
IEEE
Copyright (Published Version)
2016 IEEE
Web versions
Language
English
Status of Item
Peer reviewed
Conference Details
2016 4th IEEE International Symposium on Digital Forensics and Security (ISDFS), Arkansas, USA, 25 - 27 April 2016
This item is made available under a Creative Commons License
File(s)
Owning collection
Scopus© citations
7
Acquisition Date
Mar 28, 2024
Mar 28, 2024
Views
1522
Last Week
1
1
Last Month
1
1
Acquisition Date
Mar 28, 2024
Mar 28, 2024
Downloads
444
Last Month
4
4
Acquisition Date
Mar 28, 2024
Mar 28, 2024