NDLI: Metaware — An extensible malware detection and removal toolkit

Content Provider	IEEE Xplore Digital Library
Author	Chan Lee Yee Lee Ling Chuan Ismail, M. Jumari, K.
Copyright Year	2011
Description	Author affiliation: Malaysia Computer Emergency Response Team, CyberSecurity Malaysia (Lee Ling Chuan) \|\| Department of Electrical, Electronic Ana System Engineering, Universiti Kebangsaan Malaysia (Chan Lee Yee; Ismail, M.; Jumari, K.)
Abstract	Malicious code is a threat to computer security globally. The threat is evolving and leaving challenges for security specialists to improve the detection accuracy. Hence, it is imperative to optimize the traditional manual analysis method by automatic malicious code analysis system. Automatic protocol reverse-engineering is important for many security applications, including the verification of objects and detections of malware. In this paper, we propose a new approach to computer security via automating malware analysis. This project uses combination of auto-unpacked, heuristic, disassembler and emulator techniques to find and block malicious program before the malicious software executed locally. Auto-unpacked contains self-decryption algorithms, where the script codes help quickly decipher script bodies for further analysis. Heuristic analysis is designed to analyze disassemble code contain within a suspicious program. The disassemble code of the suspicious file is compared with a known virus signature database. If the disassemble code matches with the code of the database signature, the file is flagged. The emulator is design to scans code, imitates the way they are executing, and monitoring their actions, preventing any actual damage from being dealt to the computer system or user data. Verdicts on whether or not a program poses a threat are issued based on the results of behaviour analyses. The emulator makes it possible to find malicious code that are intentionally masked to prevent detection using encryption and obfuscated code. Overall, we present our motivation for designing the system and give an overview of the system architecture.
Starting Page	996
Ending Page	1000
File Size	699878
Page Count	5
File Format	PDF
ISBN	9781424488308
ISSN	17389445
e-ISBN	9788955191554
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2011-02-13
Publisher Place	Korea (South)
Access Restriction	Subscribed
Rights Holder	Global IT Research Inst
Subject Keyword	Malware Databases Software Registers Emulation Reverse engineering Viruses (medical) Emulator Computer System Security Virus Detection Malware Reverse Engineering Disassembler
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Design and development of a new scanning core engine for malware detection

Virus detection using data mining techinques

Non-normalizable functions: A new method to generate metamorphic malware

Limits of Static Analysis for Malware Detection

Stealthy code obfuscation technique for software security

The Design and Implementation of an Antivirus Software Advising System

Inductive Learning in Malware Detection

Design of Mobile Phone Security System Based on Detection of Abnormal Behavior

Multiple Equivalent Scale Scan: An Enhancing Technique for Malware Detection

Metaware — An extensible malware detection and removal toolkit

Similar Documents

Design and development of a new scanning core engine for malware detection

Virus detection using data mining techinques

Non-normalizable functions: A new method to generate metamorphic malware

Limits of Static Analysis for Malware Detection

Stealthy code obfuscation technique for software security

The Design and Implementation of an Antivirus Software Advising System

Inductive Learning in Malware Detection

Design of Mobile Phone Security System Based on Detection of Abnormal Behavior

Multiple Equivalent Scale Scan: An Enhancing Technique for Malware Detection

Metaware — An extensible malware detection and removal toolkit