NDLI: Defining malware families based on analyst insights

Content Provider	IEEE Xplore Digital Library
Author	Gennari, J. French, D.
Copyright Year	2011
Description	Author affiliation: CERT Program Software Engineering Institute, Carnegie Mellon University Pittsburgh, Pennsylvania 15213 (Gennari, J.; French, D.)
Abstract	Determining whether arbitrary files are related to known malicious files is often useful in network and host-based defense. Doing so can give network defenders sufficient exemplars of a particular threat to develop comprehensive signatures and heuristics for identifying the threat, leading to decreased response time and improved prevention of a cyber attack. Identifying these malicious families is a complex process involving the categorization of potentially malicious code into sets that share similar features, while being distinguishable from unrelated threats or non-malicious code. Current methods for automatically or manually describing malware families are typically unable to distinguish between indicators derived from the structure of the malware and indicators derived from the behavior of the malware. Further, attempts to cluster potentially related files by mapping them into alternate domains, including histograms, fuzzy hashes, Bloom filters, and so on often produces clusters of files solely derived from structural information. These similarity measurements are often very effective on crudely similar files, yet they fail to identify files that have similar or identical behavior and semantics. We propose an analytic method, driven largely by human experience and based on objective criteria, for assigning arbitrary files membership in a malicious code family. We describe a process for iteratively refining the criteria used to select a malicious code family, until such criteria described are both necessary and sufficient to distinguish a particular malicious code family. We contrast this process with similar processes, such as antivirus signature generation and automatic and blind classification methods. We formalize this process to describe a roadmap for practitioners of malicious code analysis and to highlight opportunities for improvement and automation of both the process and the observation of relevant criteria. Finally, we provide experimental results of applying this methodology to real-world malware.
Starting Page	396
Ending Page	401
File Size	414746
Page Count	6
File Format	PDF
ISBN	9781457713750
e-ISBN	9781457713767
DOI	10.1109/THS.2011.6107902
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2011-11-15
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Algorithm design and analysis Runtime Reverse engineering Humans Implants Malware
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Reverse Engineering Self-Modifying Code: Unpacker Extraction

Automatic Reverse Engineering of Malware Emulators

An efficient common substrings algorithm for on-the-fly behavior-based malware detection and analysis

Virtualization Evolution For Transparent Malware Analysis

MCARTA: A Malicious Code Automated Run-Time Analysis framework

Unity in Diversity: Phylogenetic-inspired Techniques for Reverse Engineering and Detection of Malware Families

Malware analysis reverse engineering (MARE) methodology & malware defense (M.D.) timeline

Malware analysis using reverse engineering and data mining tools

Reversing Engineering Data Structures in Binary Programs: Overview and Case Study

Defining malware families based on analyst insights

Similar Documents

Reverse Engineering Self-Modifying Code: Unpacker Extraction

Automatic Reverse Engineering of Malware Emulators

An efficient common substrings algorithm for on-the-fly behavior-based malware detection and analysis

Virtualization Evolution For Transparent Malware Analysis

MCARTA: A Malicious Code Automated Run-Time Analysis framework

Unity in Diversity: Phylogenetic-inspired Techniques for Reverse Engineering and Detection of Malware Families

Malware analysis reverse engineering (MARE) methodology & malware defense (M.D.) timeline

Malware analysis using reverse engineering and data mining tools

Reversing Engineering Data Structures in Binary Programs: Overview and Case Study

Defining malware families based on analyst insights