Gorille sniffs code similarities, the case study of Qwerty versus Regin

Guillaume Bonfante 1 Jean-Yves Marion 1 Fabrice Sabatier 1
1 CARTE - Theoretical adverse computations, and safety
Inria Nancy - Grand Est, LORIA - FM - Department of Formal Methods
Abstract : In the last decade, our group has developed a tool called Gorille which implements morphological analysis, roughly speaking control graph comparison of malware. Our first intention was to use it for malware detection, and this works quite well as already presented in [2]. However , morphological analysis outputs a more refine output than 'yes' or 'no'. In the current contribution, we show that it can be used in several ways for retro-engineering. First, we describe a rapid triggering process that enlighten code similarities. Second, we present a function identification mechanism which aim is to reveal some key code in a malware. Finally, we supply a procedure which separate different families of code given some samples. All these tasks are done (almost) automatically seen from a retro-engineering perspective.
Type de document :
Communication dans un congrès
Fernando Colon Osorio. Malware Conference, Oct 2015, Fajardo, Puerto Rico. IEEE, pp.8
Liste complète des métadonnées

Littérature citée [7 références]  Voir  Masquer  Télécharger

https://hal.inria.fr/hal-01263123
Contributeur : Guillaume Bonfante <>
Soumis le : mercredi 27 janvier 2016 - 13:58:25
Dernière modification le : jeudi 11 janvier 2018 - 06:21:25
Document(s) archivé(s) le : jeudi 28 avril 2016 - 11:22:05

Fichier

malware2015.pdf
Fichiers produits par l'(les) auteur(s)

Identifiants

  • HAL Id : hal-01263123, version 1

Collections

Citation

Guillaume Bonfante, Jean-Yves Marion, Fabrice Sabatier. Gorille sniffs code similarities, the case study of Qwerty versus Regin. Fernando Colon Osorio. Malware Conference, Oct 2015, Fajardo, Puerto Rico. IEEE, pp.8. 〈hal-01263123〉

Partager

Métriques

Consultations de la notice

431

Téléchargements de fichiers

1366