A concept for monitoring self-transforming code using memory page access control management
Christian Maaser, Harald Baier · 2011
Current antivirus software still focuses on using signature based algorithms on file content level to detect malware. Unfortunately, there is a simple way to circumvent this detection method: The malware author applies a code transformation algorithm (e.g. a packing or encryption scheme) to his malware plaintext and saves the reverse transformation algorithm along with the unsuspicious looking block of transformed mal-ware. Malware, which is obfuscated in that way, is called polymorphic malware. We call the transformation of the plaintext to the transformed malware as encoding and the reverse operation as decoding. Although current malware detection systems adopted and implemented several techniques to counter this, these methods are mostly either unreliable or suffer heavy performance drawbacks. We present a non-intrusive and lightweight method to monitor any executable code in real-time, which allows efficient detection of polymorphic malware.