標題: Fast Discovery of VM-Sensitive Divergence Points with Basic Block Comparison
作者: Liu, Yen-Ju
Chen, Chong-Kuan
Cho, Michael Cheng Yi
Shich, Shiuhpyng
資訊工程學系
Department of Computer Science
關鍵字: Malware Behavior Analysis;VM-Aware Malware;Virtual Machine
公開日期: 1-一月-2014
摘要: To evade VM-based malware analysis systems, VM-aware malware equipped with the ability to detect the presence of virtual machine has appeared. To cope with the problem, detecting VM-aware malware and locating VM-sensitive divergence points of VM-aware malware is in urgent need. In this paper, we propose a novel block-based divergence locator. In contrast to the conventional instruction-based schemes, the block-based divergence locator divides malware program into basic blocks, instead of binary instructions, and uses them as the analysis unit. The block-based divergence locator significantly decrease the cost of behavior logging and trace comparison, as well as the size of behavior traces. As the evaluation showed, behavior logging is 23.87-39.49 times faster than the conventional schemes. The total number of analysis unit, which is highly related to the cost of trace comparisons, is 11.95%-16.00% of the conventional schemes. Consequently, VM-sensitive divergence points can be discovered more efficiently. The correctness of our divergence point discovery algorithm is also proved formally in this paper.
URI: http://dx.doi.org/10.1109/SERE.2014.33
http://hdl.handle.net/11536/128598
ISBN: 978-1-4799-4296-1
ISSN: 2378-3877
DOI: 10.1109/SERE.2014.33
期刊: 2014 EIGHTH INTERNATIONAL CONFERENCE ON SOFTWARE SECURITY AND RELIABILITY
起始頁: 196
結束頁: 205
顯示於類別:會議論文