CT-T: Using Structural and Behavioral Models to Detect Malware

点击翻译按钮获取中文摘要

Proposal Number: 0627783PI: Giovanni Vigna Institution: University of California, Santa Barbara Title: Using Structural and Behavioral Models to Detect Malware AbstractIn the past few years, malicious software (malware) has evolved and diversified. Simple viruses that attach to existing programs and require action on behalf of a user to execute have evolved into worms that can infectthousands of hosts and disrupt entire networks. Rootkits and Trojan horses have evolved from simple programs that mimic legitimate applications for malicious purposes into sophisticated software components that operate at the OS kernel level, making it difficult to detect and eradicate them. In addition, completely new types of malware, such as spyware and adware, have emerged.Unfortunately, the evolution of malware has not been matched by a corresponding evolution in defense tools. Most malware detection tools are syntax-based and use relatively simple pattern matching techniques. Thesetechniques can only recognize known malware, and, in addition, they can be easily fooled by sophisticated malware that uses obfuscation and polymorphic techniques.To be able to reliably detect sophisticated malware it is necessary to develop analysis techniques that rely on information other than the syntactic structure of the program. Therefore, this research effort will focus ondeveloping novel binary analysis techniques that use structural and behavioral models to detect sophisticated malware. More precisely, the proposed techniques use a composition of static and dynamic analysis to identify code whose behavior is similar to the behavior of malware such as viruses, worms, spyware programs, or rootkits. This approach will allow one to detect previously unseen malware and identify mutations of known malware.