DiffSig: Resource Differentiation Based Malware Behavioral Concise Signature Generation - Information and Communication Technology Access content directly
Conference Papers Year : 2013

DiffSig: Resource Differentiation Based Malware Behavioral Concise Signature Generation

Huabiao Lu
  • Function : Author
  • PersonId : 1003073
Baokang Zhao
  • Function : Author
  • PersonId : 1003074
Xiaofeng Wang
  • Function : Author
  • PersonId : 993526
Jinshu Su
  • Function : Author
  • PersonId : 994595

Abstract

Malware obfuscation obscures malware into a different form that’s functionally identical to the original one, and makes syntactic signature ineffective. Furthermore, malware samples are huge and growing at an exponential pace. Behavioral signature is an effective way to defeat obfuscation. However, state-of-the-art behavioral signature, behavior graph, is although very effective but unfortunately too complicated and not scalable to handle exponential growing malware samples; in addition, it is too slow to be used as real-time detectors. This paper proposes an anti-obfuscation and scalable behavioral signature generation system, DiffSig, which voids information-flow tracking which is the chief culprit for the complex and inefficiency of graph behavior, thus, losing some data dependencies, but describes handle dependencies more accurate than graph behavior by restrict the profile type of resource that each handle dependency can reference to. Our experiment results show that DiffSig is scalable and efficient, and can detect new malware samples effectively.
Fichier principal
Vignette du fichier
978-3-642-36818-9_28_Chapter.pdf (172.94 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-01480181 , version 1 (01-03-2017)

Licence

Attribution

Identifiers

Cite

Huabiao Lu, Baokang Zhao, Xiaofeng Wang, Jinshu Su. DiffSig: Resource Differentiation Based Malware Behavioral Concise Signature Generation. 1st International Conference on Information and Communication Technology (ICT-EurAsia), Mar 2013, Yogyakarta, Indonesia. pp.271-284, ⟨10.1007/978-3-642-36818-9_28⟩. ⟨hal-01480181⟩
42 View
166 Download

Altmetric

Share

Gmail Facebook X LinkedIn More