Architecture of a morphological malware detector
Identifieur interne : 004420 ( Main/Exploration ); précédent : 004419; suivant : 004421Architecture of a morphological malware detector
Auteurs : Guillaume Bonfante [France] ; Matthieu Kaczmarek [France] ; Jean-Yves Marion [France]Source :
- Journal in Computer Virology [ 1772-9890 ] ; 2009-08-01.
English descriptors
- mix :
Abstract
Abstract: Most of malware detectors are based on syntactic signatures that identify known malicious programs. Up to now this architecture has been sufficiently efficient to overcome most of malware attacks. Nevertheless, the complexity of malicious codes still increase. As a result the time required to reverse engineer malicious programs and to forge new signatures is increasingly longer. This study proposes an efficient construction of a morphological malware detector, that is a detector which associates syntactic and semantic analysis. It aims at facilitating the task of malware analysts providing some abstraction on the signature representation which is based on control flow graphs. We build an efficient signature matching engine over tree automata techniques. Moreover we describe a generic graph rewriting engine in order to deal with classic mutations techniques. Finally, we provide a preliminary evaluation of the strategy detection carrying out experiments on a malware collection.
Url:
DOI: 10.1007/s11416-008-0102-4
Affiliations:
Links toward previous steps (curation, corpus...)
- to stream Istex, to step Corpus: 002C17
- to stream Istex, to step Curation: 002B80
- to stream Istex, to step Checkpoint: 000E48
- to stream Hal, to step Corpus: 000F79
- to stream Hal, to step Curation: 000F79
- to stream Hal, to step Checkpoint: 002F98
- to stream Main, to step Merge: 004531
- to stream Main, to step Curation: 004420
Le document en format XML
<record><TEI wicri:istexFullTextTei="biblStruct"><teiHeader><fileDesc><titleStmt><title xml:lang="en">Architecture of a morphological malware detector</title>
<author><name sortKey="Bonfante, Guillaume" sort="Bonfante, Guillaume" uniqKey="Bonfante G" first="Guillaume" last="Bonfante">Guillaume Bonfante</name>
</author>
<author><name sortKey="Kaczmarek, Matthieu" sort="Kaczmarek, Matthieu" uniqKey="Kaczmarek M" first="Matthieu" last="Kaczmarek">Matthieu Kaczmarek</name>
</author>
<author><name sortKey="Marion, Jean Yves" sort="Marion, Jean Yves" uniqKey="Marion J" first="Jean-Yves" last="Marion">Jean-Yves Marion</name>
</author>
</titleStmt>
<publicationStmt><idno type="wicri:source">ISTEX</idno>
<idno type="RBID">ISTEX:BA4B8A0EB4255540EEEB6D10986D68BE2E383B5B</idno>
<date when="2008" year="2008">2008</date>
<idno type="doi">10.1007/s11416-008-0102-4</idno>
<idno type="url">https://api.istex.fr/ark:/67375/VQC-FNF1LS00-Q/fulltext.pdf</idno>
<idno type="wicri:Area/Istex/Corpus">002C17</idno>
<idno type="wicri:explorRef" wicri:stream="Istex" wicri:step="Corpus" wicri:corpus="ISTEX">002C17</idno>
<idno type="wicri:Area/Istex/Curation">002B80</idno>
<idno type="wicri:Area/Istex/Checkpoint">000E48</idno>
<idno type="wicri:explorRef" wicri:stream="Istex" wicri:step="Checkpoint">000E48</idno>
<idno type="wicri:doubleKey">1772-9890:2008:Bonfante G:architecture:of:a</idno>
<idno type="wicri:source">HAL</idno>
<idno type="RBID">Hal:inria-00330022</idno>
<idno type="url">https://hal.inria.fr/inria-00330022</idno>
<idno type="wicri:Area/Hal/Corpus">000F79</idno>
<idno type="wicri:Area/Hal/Curation">000F79</idno>
<idno type="wicri:Area/Hal/Checkpoint">002F98</idno>
<idno type="wicri:explorRef" wicri:stream="Hal" wicri:step="Checkpoint">002F98</idno>
<idno type="wicri:doubleKey">1772-9890:2009:Bonfante G:architecture:of:a</idno>
<idno type="wicri:Area/Main/Merge">004531</idno>
<idno type="wicri:Area/Main/Curation">004420</idno>
<idno type="wicri:Area/Main/Exploration">004420</idno>
</publicationStmt>
<sourceDesc><biblStruct><analytic><title level="a" type="main" xml:lang="en">Architecture of a morphological malware detector</title>
<author><name sortKey="Bonfante, Guillaume" sort="Bonfante, Guillaume" uniqKey="Bonfante G" first="Guillaume" last="Bonfante">Guillaume Bonfante</name>
<affiliation wicri:level="4"><country xml:lang="fr">France</country>
<wicri:regionArea>Nancy-Université, Loria, INPL, Ecole Nationale Supérieure des Mines de Nancy, B.P. 239, 54506, Vandœuvre-lès-Nancy Cédex</wicri:regionArea>
<placeName><region type="region" nuts="2">Grand Est</region>
<region type="old region" nuts="2">Lorraine (région)</region>
<settlement type="city">Vandœuvre-lès-Nancy Cédex</settlement>
</placeName>
<orgName type="university">Nancy-Université</orgName>
</affiliation>
</author>
<author><name sortKey="Kaczmarek, Matthieu" sort="Kaczmarek, Matthieu" uniqKey="Kaczmarek M" first="Matthieu" last="Kaczmarek">Matthieu Kaczmarek</name>
<affiliation wicri:level="4"><country xml:lang="fr">France</country>
<wicri:regionArea>Nancy-Université, Loria, INPL, Ecole Nationale Supérieure des Mines de Nancy, B.P. 239, 54506, Vandœuvre-lès-Nancy Cédex</wicri:regionArea>
<placeName><region type="region" nuts="2">Grand Est</region>
<region type="old region" nuts="2">Lorraine (région)</region>
<settlement type="city">Vandœuvre-lès-Nancy Cédex</settlement>
</placeName>
<orgName type="university">Nancy-Université</orgName>
</affiliation>
<affiliation></affiliation>
</author>
<author><name sortKey="Marion, Jean Yves" sort="Marion, Jean Yves" uniqKey="Marion J" first="Jean-Yves" last="Marion">Jean-Yves Marion</name>
<affiliation wicri:level="4"><country xml:lang="fr">France</country>
<wicri:regionArea>Nancy-Université, Loria, INPL, Ecole Nationale Supérieure des Mines de Nancy, B.P. 239, 54506, Vandœuvre-lès-Nancy Cédex</wicri:regionArea>
<placeName><region type="region" nuts="2">Grand Est</region>
<region type="old region" nuts="2">Lorraine (région)</region>
<settlement type="city">Vandœuvre-lès-Nancy Cédex</settlement>
</placeName>
<orgName type="university">Nancy-Université</orgName>
</affiliation>
</author>
</analytic>
<monogr></monogr>
<series><title level="j">Journal in Computer Virology</title>
<title level="j" type="abbrev">J Comput Virol</title>
<idno type="ISSN">1772-9890</idno>
<idno type="eISSN">1772-9904</idno>
<imprint><publisher>Springer-Verlag</publisher>
<pubPlace>Paris</pubPlace>
<date type="published" when="2009-08-01">2009-08-01</date>
<biblScope unit="volume">5</biblScope>
<biblScope unit="issue">3</biblScope>
<biblScope unit="page" from="263">263</biblScope>
<biblScope unit="page" to="270">270</biblScope>
</imprint>
<idno type="ISSN">1772-9890</idno>
</series>
</biblStruct>
</sourceDesc>
<seriesStmt><idno type="ISSN">1772-9890</idno>
</seriesStmt>
</fileDesc>
<profileDesc><textClass><keywords scheme="mix" xml:lang="en"><term>control flow graph</term>
<term>detection</term>
<term>malware</term>
<term>mutations</term>
<term>signature</term>
</keywords>
</textClass>
<langUsage><language ident="en">en</language>
</langUsage>
</profileDesc>
</teiHeader>
<front><div type="abstract" xml:lang="en">Abstract: Most of malware detectors are based on syntactic signatures that identify known malicious programs. Up to now this architecture has been sufficiently efficient to overcome most of malware attacks. Nevertheless, the complexity of malicious codes still increase. As a result the time required to reverse engineer malicious programs and to forge new signatures is increasingly longer. This study proposes an efficient construction of a morphological malware detector, that is a detector which associates syntactic and semantic analysis. It aims at facilitating the task of malware analysts providing some abstraction on the signature representation which is based on control flow graphs. We build an efficient signature matching engine over tree automata techniques. Moreover we describe a generic graph rewriting engine in order to deal with classic mutations techniques. Finally, we provide a preliminary evaluation of the strategy detection carrying out experiments on a malware collection.</div>
</front>
</TEI>
<affiliations><list><country><li>France</li>
</country>
<region><li>Grand Est</li>
<li>Lorraine (région)</li>
</region>
<settlement><li>Vandœuvre-lès-Nancy Cédex</li>
</settlement>
<orgName><li>Nancy-Université</li>
</orgName>
</list>
<tree><country name="France"><region name="Grand Est"><name sortKey="Bonfante, Guillaume" sort="Bonfante, Guillaume" uniqKey="Bonfante G" first="Guillaume" last="Bonfante">Guillaume Bonfante</name>
</region>
<name sortKey="Kaczmarek, Matthieu" sort="Kaczmarek, Matthieu" uniqKey="Kaczmarek M" first="Matthieu" last="Kaczmarek">Matthieu Kaczmarek</name>
<name sortKey="Marion, Jean Yves" sort="Marion, Jean Yves" uniqKey="Marion J" first="Jean-Yves" last="Marion">Jean-Yves Marion</name>
</country>
</tree>
</affiliations>
</record>
Pour manipuler ce document sous Unix (Dilib)
EXPLOR_STEP=$WICRI_ROOT/Wicri/Lorraine/explor/InforLorV4/Data/Main/Exploration
HfdSelect -h $EXPLOR_STEP/biblio.hfd -nk 004420 | SxmlIndent | more
Ou
HfdSelect -h $EXPLOR_AREA/Data/Main/Exploration/biblio.hfd -nk 004420 | SxmlIndent | more
Pour mettre un lien sur cette page dans le réseau Wicri
{{Explor lien |wiki= Wicri/Lorraine |area= InforLorV4 |flux= Main |étape= Exploration |type= RBID |clé= ISTEX:BA4B8A0EB4255540EEEB6D10986D68BE2E383B5B |texte= Architecture of a morphological malware detector }}
![]() | This area was generated with Dilib version V0.6.33. | ![]() |