Software Fingerprinting for Automated Malicious Code Analysis

点击翻译按钮获取中文摘要

The current project pertains to the domain of software reverse engineering with applications to malware analysis. The project goals are the development of new malware analysis techniques, with their associated theoretical foundations, algorithms and tools to be run in a realistic reverse engineering environment so that the malware reverse engineering process be accelerated. The current research privileges a static approach which could yield better results and more interesting insights into the malware code compared to a dynamic approach. Automating the identification of code fragments which have been reused from previously analyzed assembly code, which potentially reuse existing open source code, as well as featuring the origins and authorship of malware assembly code, are some of the concrete expected results from this research. The research works will focus on reducing the search space to automatically match assembly code with source code at a low false positive rate. Given that each assembly code fragment may present a variant whilst maintaining the same functionality, a system for searching assembly code clones by using novel data mining techniques on indexed and analyzed assembly code will be designed. It will be heavily tested and characterized in terms of complexity detection, accuracy, efficiency and scalability. As to identifying the creator of an assembly code, novel techniques will be certainly proposed and tested in real case scenarios, since the source code level authorship techniques are unsuitable (the compiler will have removed most of the features shaping a programmer's style). Overall, the project results represent different facets of a single goal - ensuring a systematic and structural knowledge of the malware assembly code and thus considerably lighten the burden of any reverse engineer.