Towards Malware Author Attribution

点击翻译按钮获取中文摘要

In 2008 Symantec added 1.6 million new malware signatures to its malware database. This number increased to 2.9 million in 2009. In 2010, the new addition to the database constituted 4.4 million new signatures. This trend continued, and in 2011 an increase in malware has reached 41%. Traditional approaches predominantly based on recognizing well-documented threats (signatures) are struggling to cope with this rate of growth in malware numbers each year. Consequently, the majority of malware strains (many of which are short lived, i.e., less than 24 hours) go undetected. This inadequacy of traditional approaches exposes a dire need for alternative defences. We propose to turn our attention to malware source, i.e, malware authors. The benefit of such a strategy is clear: instead of detecting every malware strain, we could effectively characterize all malware variants generated by its author. We propose to study the theory and practice behind malware author attribution. Although authorship attribution, a technique aiming to determine an author of a document given some textual characteristics of the author's writing style extracted from his previous works, is well established in social science, it raises many research questions in malware detection domain. For example, how can we define an author (e.g., malware generation engine, a malware campaign, an individual) so that it can be leveraged for automatic and accurate detection, and to what extend source and binary code embed distinct features traceable to its author.**