Software Fingerprinting for Automated Malicious Code Analysis

当前的项目属于针对恶意软件的应用程序的软件逆向工程领域 分析。该项目的目标是开发新的恶意软件分析技术，以及与其相关的 在现实的逆向工程环境中运行的理论基础、算法和工具 加快恶意软件逆向工程进程。目前的研究优先于静态方法，即 与动态方法相比，可以产生更好的结果和对恶意软件代码更有趣的见解。 自动识别已从先前分析的程序集中重用的代码段 代码，这可能会重用现有的开放源代码，并以 恶意软件汇编代码，是这项研究的一些具体预期结果。研究工作将 专注于缩小搜索空间，以自动将汇编代码与源代码匹配在较低的错误水平 阳性率。假设每个汇编代码段可以在保持相同的同时呈现一个变体 功能，通过使用新的数据挖掘技术在索引上搜索汇编代码克隆的系统 并对分析后的汇编代码进行设计。它将经过严格的测试，并以复杂性为特征 检测性、准确性、效率和可扩展性。至于确定汇编代码的创建者，小说 技术当然会被提出并在真实案例场景中进行测试，因为源代码级别的作者身份 技术是不合适的(编译器将移除塑造程序员风格的大部分功能)。 总体而言，项目成果代表了单一目标的不同方面--确保系统和结构 了解恶意软件汇编代码，从而大大减轻任何反向工程师的负担。

The current project pertains to the domain of software reverse engineering with applications to malware analysis. The project goals are the development of new malware analysis techniques, with their associated theoretical foundations, algorithms and tools to be run in a realistic reverse engineering environment so that the malware reverse engineering process be accelerated. The current research privileges a static approach which could yield better results and more interesting insights into the malware code compared to a dynamic approach. Automating the identification of code fragments which have been reused from previously analyzed assembly code, which potentially reuse existing open source code, as well as featuring the origins and authorship of malware assembly code, are some of the concrete expected results from this research. The research works will focus on reducing the search space to automatically match assembly code with source code at a low false positive rate. Given that each assembly code fragment may present a variant whilst maintaining the same functionality, a system for searching assembly code clones by using novel data mining techniques on indexed and analyzed assembly code will be designed. It will be heavily tested and characterized in terms of complexity detection, accuracy, efficiency and scalability. As to identifying the creator of an assembly code, novel techniques will be certainly proposed and tested in real case scenarios, since the source code level authorship techniques are unsuitable (the compiler will have removed most of the features shaping a programmer's style). Overall, the project results represent different facets of a single goal - ensuring a systematic and structural knowledge of the malware assembly code and thus considerably lighten the burden of any reverse engineer.