NDLI: A method for detecting obfuscated calls in malicious binaries

Please wait, while we are loading the content...

A method for detecting obfuscated calls in malicious binaries

Content Provider	IEEE Xplore Digital Library
Author	Arun Lakhotia Eric Uday Kumar Venable, M.
Copyright Year	1976
Abstract	Information about calls to the operating system (or kernel libraries) made by a binary executable may be used to determine whether the binary is malicious. Being aware of this approach, malicious programmers hide this information by making such calls without using the call instruction. For instance, the call addr instruction may be replaced by two push instructions and a ret instruction, the first push pushes the address of instruction after the ret instruction, and the second push pushes the address addr. The code may be further obfuscated by spreading the three instructions and by splitting each instruction into multiple instructions. This work presents a method to statically detect obfuscated calls in binary code. The idea is to use abstract interpretation to detect where the normal call-ret convention is violated. These violations can be detected by what is called an abstract stack graph. An abstract stack graph is a concise representation of all potential abstract stacks at every point in a program. An abstract stack is used to associate each element in the stack to the instruction that pushes the element. An algorithm for constructing the abstract stack graph is also presented. Methods for using the abstract stack graph are shown to detect eight different obfuscations. The technique is demonstrated by implementing a prototype tool called DOC (detector for obfuscated calls).
Sponsorship	IEEE Computer Society Technical Council on Software Engineering Association for Computing Machinery (ACM) IEEE Computer Society
Starting Page	955
Ending Page	968
Page Count	14
File Size	1374981
File Format	PDF
ISSN	00985589
Volume Number	31
Issue Number	11
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2005-11-01
Publisher Place	U.S.A.
Access Restriction	One Nation One Subscription (ONOS)
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Kernel Performance analysis Laboratories Operating systems Libraries Programming profession Binary codes Software prototyping Prototypes Detectors abstract stack. Index Terms- Invasive software (viruses worms) program analysis validation obfuscation
Content Type	Text
Resource Type	Article
Subject	Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

MicroScope: a knowledge-based programming environment

Writing Code to Prototype, Ideate, and Discover

Observations on the Evolution of a Software System

Deobfuscation, unpacking, and decoding of obfuscated malicious JavaScript for machine learning models detection performance improvement

Lightweight Detection Method of Obfuscated Landing Sites Based on the AST Structure and Tokens

Hybrid Obfuscated Javascript Strength Analysis System for Detection of Malicious Websites

Exception-oriented programming: retrofitting code-reuse attacks to construct kernel malware

PELAS-program error-locating assistant system

Distrbution and Abstract Types in Emerald

A method for detecting obfuscated calls in malicious binaries

Similar Documents

MicroScope: a knowledge-based programming environment

Writing Code to Prototype, Ideate, and Discover

Observations on the Evolution of a Software System

Deobfuscation, unpacking, and decoding of obfuscated malicious JavaScript for machine learning models detection performance improvement

Lightweight Detection Method of Obfuscated Landing Sites Based on the AST Structure and Tokens

Hybrid Obfuscated Javascript Strength Analysis System for Detection of Malicious Websites

Exception-oriented programming: retrofitting code-reuse attacks to construct kernel malware

PELAS-program error-locating assistant system

Distrbution and Abstract Types in Emerald

A method for detecting obfuscated calls in malicious binaries