Skip to Main content Skip to Navigation
Journal articles

Architecture of a Morphological Malware Detector

Guillaume Bonfante 1 Matthieu Kaczmarek 1 Jean-Yves Marion 1
1 CARTE - Theoretical adverse computations, and safety
Inria Nancy - Grand Est, LORIA - FM - Department of Formal Methods
Abstract : Most of malware detectors are based on syntactic signatures that identify known malicious programs. Up to now this architecture has been sufficiently efficient to overcome most of malware attacks. Nevertheless, the complexity of malicious codes still increase. As a result the time required to reverse engineer malicious programs and to forge new signatures is increasingly longer. This study proposes an efficient construction of a morphological malware detector, that is a detector which associates syntactic and semantic analysis. It aims at facilitating the task of malware analysts providing some abstraction on the signature representation which is based on control flow graphs (CFG). We build an efficient signature matching engine over tree automata techniques. Moreover we describe a generic graph rewriting engine in order to deal with classic mutations techniques. Finally, we provide a preliminary evaluation of the strategy detection carrying out experiments on a malware collection.
Document type :
Journal articles
Complete list of metadata

Cited literature [12 references]  Display  Hide  Download
Contributor : Matthieu Kaczmarek Connect in order to contact the contributor
Submitted on : Monday, October 13, 2008 - 9:47:51 PM
Last modification on : Saturday, October 16, 2021 - 11:26:05 AM
Long-term archiving on: : Tuesday, October 9, 2012 - 12:06:37 PM


Files produced by the author(s)




Guillaume Bonfante, Matthieu Kaczmarek, Jean-Yves Marion. Architecture of a Morphological Malware Detector. Journal in Computer Virology, Springer Verlag, 2009, 5 (3), pp.263-270. ⟨10.1007/s11416-008-0102-4⟩. ⟨inria-00330022⟩



Record views


Files downloads