NDLI: Extracting Sent Message Formats from Executables Using Backward Slicing

Content Provider	IEEE Xplore Digital Library
Author	Min Liu Chunfu Jia Lu Liu Zhi Wang
Copyright Year	2013
Description	Author affiliation: Coll. of Inf. Tech. Sci., Nankai Univ., Tianjin, China (Min Liu; Chunfu Jia; Lu Liu; Zhi Wang)
Abstract	Network communication protocol reverse-engineering is important for malicious software analysis. Security analysts need to rewrite messages sent and received by malicious software according to the protocol to control the malware's malicious behaviors. To enable such rewriting, we need detailed information about the sent message by the malware program in target host in the network dialog. However, recent works on sent message extraction have limitations and the source code of malware program is usually not obtained. This paper proposes an analysis method to extract sent message format by processing executables. This paper obtains the reliable execution trace of malware program firstly, then gets the syntax structure of the send buffer of sent function combining the binary code analysis technique with the binary dynamic backward program slicing technique. Finally we exploit the dynamic taint analysis to extract the semantic information of different syntax fields. The experimental results show that our analysis framework can effectively analyze format information of malware's sent message.
Starting Page	377
Ending Page	384
File Size	192583
Page Count	8
File Format	PDF
e-ISBN	9781479921416
DOI	10.1109/EIDWT.2013.71
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2013-09-09
Publisher Place	China
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Protocols Semantics Malicious software Syntactics Software Silicon Performance analysis Sent message Dynamic program slicing Monitoring Dynamic taint analysis
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Extracting Output Formats from Executables

Assertion-based Slicing and Slice Graphs

On the Accuracy of Forward Dynamic Slicing and Its Effects on Software Maintenance

Malicious data classification using structural information and behavioral specifications in executables

Dynamic Detection of Unknown Malicious Executables Base on API Interception

Using Backward Dynamic Program Slicing to Isolate Influencing Statements in GDB 21 (2007)

A Taint Based Approach for Smart Fuzzing

How Accurate Is Dynamic Program Slicing? An Empirical Approach to Compute Accuracy Bounds

Locating faulty code using failure-inducing chops

Extracting Sent Message Formats from Executables Using Backward Slicing

Similar Documents

Extracting Output Formats from Executables

Assertion-based Slicing and Slice Graphs

On the Accuracy of Forward Dynamic Slicing and Its Effects on Software Maintenance

Malicious data classification using structural information and behavioral specifications in executables

Dynamic Detection of Unknown Malicious Executables Base on API Interception

Using Backward Dynamic Program Slicing to Isolate Influencing Statements in GDB 21 (2007)

A Taint Based Approach for Smart Fuzzing

How Accurate Is Dynamic Program Slicing? An Empirical Approach to Compute Accuracy Bounds

Locating faulty code using failure-inducing chops

Extracting Sent Message Formats from Executables Using Backward Slicing