A heuristic approach for detection of obfuscated malware
A heuristic approach for detection of obfuscated malware
复制标题
一种检测混淆恶意软件的启发式方法
DOI：
10.1109/isi.2009.5137328
复制
发表时间：
2009
期刊：
影响因子：
--
通讯作者：
Mian Zhou
中科院分区：
文献类型：
--
作者：
Scott Treadwell;Mian Zhou
混淆恶意软件已经变得流行，因为混淆带来的纯粹好处：混淆工具的低成本和容易获得，伴随着逃避基于签名的反病毒检测的良好效果，以及防止反向工程理解恶意软件的真实性质。无论混淆方法如何，恶意软件必须将其核心代码反混淆以清除可执行机器代码，以便执行恶意部分。因此，在解包之前分析混淆模式为我们提供了防止恶意软件进一步执行的机会。在本文中，我们提出了一种启发式检测方法，目标混淆的Windows二进制文件被加载到内存中-在执行之前。我们对二进制文件的PE结构执行一系列静态检查，以寻找打包程序或混淆的常见痕迹，并使用简单的风险评级机制来衡量二进制文件的恶意性。因此，如果新创建的进程被静态筛选标记为可能是恶意的，则该进程将被阻止进一步执行。本文探讨了这项研究的基础，以及测试方法和目前的结果。
Obfuscated malware has become popular because of pure benefits brought by obfuscation: low cost and readily availability of obfuscation tools accompanied with good result of evading signature based anti-virus detection as well as prevention of reverse engineer from understanding malwares' true nature. Regardless obfuscation methods, a malware must deobfuscate its core code back to clear executable machine code so that malicious portion will be executed. Thus, to analyze the obfuscation pattern before unpacking provide a chance for us to prevent malware from further execution. In this paper, we propose a heuristic detection approach that targets obfuscated windows binary files being loaded into memory - prior to execution. We perform a series of static check on binary file's PE structure for common traces of a packer or obfuscation, and gauge a binary's maliciousness with a simple risk rating mechanism. As a result, a newly created process, if flagged as possibly malicious by the static screening, will be prevented from further execution. This paper explores the foundation of this research, as well as the testing methodology and current results.