Architecture of a Morphological Malware Detector - Archive ouverte HAL Access content directly
Journal Articles Journal in Computer Virology Year : 2009

Architecture of a Morphological Malware Detector

(1) , (1) , (1)


Most of malware detectors are based on syntactic signatures that identify known malicious programs. Up to now this architecture has been sufficiently efficient to overcome most of malware attacks. Nevertheless, the complexity of malicious codes still increase. As a result the time required to reverse engineer malicious programs and to forge new signatures is increasingly longer. This study proposes an efficient construction of a morphological malware detector, that is a detector which associates syntactic and semantic analysis. It aims at facilitating the task of malware analysts providing some abstraction on the signature representation which is based on control flow graphs (CFG). We build an efficient signature matching engine over tree automata techniques. Moreover we describe a generic graph rewriting engine in order to deal with classic mutations techniques. Finally, we provide a preliminary evaluation of the strategy detection carrying out experiments on a malware collection.
Fichier principal
Vignette du fichier
flowgraph.pdf (316.92 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

inria-00330022 , version 1 (13-10-2008)



Guillaume Bonfante, Matthieu Kaczmarek, Jean-Yves Marion. Architecture of a Morphological Malware Detector. Journal in Computer Virology, 2009, 5 (3), pp.263-270. ⟨10.1007/s11416-008-0102-4⟩. ⟨inria-00330022⟩
201 View
705 Download



Gmail Facebook Twitter LinkedIn More