Automated Malware Invariant Generation
Rachid Rebiha, Arnaldo Moura · 2009
In our days, any social infrastructure relies on computer security and privacy: a malicious intent to a computer is a threat to society. Our project aims to design and develop a powerful binary analysis framework based on formal methods and employ the platform in order to provide automatic in-depth malware analysis. We propose a new method to detect and identify malware by generating automatically invariants directly from the specified malware code and use it as semantic aware signatures that we call malware-invariant. Also, we propose a host-based intrusion detection systems using automatically generated model where system calls are guarded by pre-computed invariant in order to report any deviation observed during the execution of the application. Our methods provides also technics for the detection of logic bugs and vulnerability in the application. Current malware detectors are “signature-based” but is it well-known that Malware writers use obfuscation to evade current detectors easily. We propose automatic semantic aware detection, identification and model extraction methods, hereby circumventing difficulties met by recent approaches.