Classification of Malware Using Structured Control Flow

I am making available my paper from the AusPDC conference http://sites.google.com/site/silviocesare/academicpublications. Any feedback or comments would be greatly appreciated.

8 responses to “Classification of Malware Using Structured Control Flow

  1. Under advice from my University, I have removed access to the paper. I will make the paper available sometime again in the future. JFYI, The reason for removing access is not related to copyright of the conference proceedings.

  2. If you can email the papers I would be very interested.

  3. Could you mail me you papers.

  4. Could you send me your papers

  5. I am a great fan of your past work….can I take a peek at the paper/algorithm?

  6. Thank you for the paper.

    I fully appreciate the important of malware classification. Everyday the number of virus is increasing….and from a talk by Kaspersky himself…he mentioned that his AV software never forget any signature. So it really puzzle me how are they copying with the exponential growth in the virus and yet able to match all of these via normal pattern matching. Your control flow approach seemed like not much different from the normal pattern matching approach. Ie, if polymorphism is able to change the pattern, normally polymorphism will introduce new control path to make it look different from past control path. Am I right?

  7. It’s observed that polymorphism does not affact the control flow as much. Most polymorphic techniques affect instruction and byte level content, but leave the control flow relatively unchanged. It is possible to add dead code that incorporates branching as you mention – which would affect the control flow. However, we can perform approximate matching of the control flow also. We can also perform dead code elimination as per usual that might be a useful normalization step. The general observation is that control flow is a stronger feature to use than byte or instruction level content because it captures a hint of what the underlying semantics are.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s