Journal in Computer Virology

, Volume 5, Issue 3, pp 263–270

Architecture of a morphological malware detector

  • Guillaume Bonfante
  • Matthieu Kaczmarek
  • Jean-Yves Marion
Eicar 2008 extended version

DOI: 10.1007/s11416-008-0102-4

Cite this article as:
Bonfante, G., Kaczmarek, M. & Marion, JY. J Comput Virol (2009) 5: 263. doi:10.1007/s11416-008-0102-4

Abstract

Most of malware detectors are based on syntactic signatures that identify known malicious programs. Up to now this architecture has been sufficiently efficient to overcome most of malware attacks. Nevertheless, the complexity of malicious codes still increase. As a result the time required to reverse engineer malicious programs and to forge new signatures is increasingly longer. This study proposes an efficient construction of a morphological malware detector, that is a detector which associates syntactic and semantic analysis. It aims at facilitating the task of malware analysts providing some abstraction on the signature representation which is based on control flow graphs. We build an efficient signature matching engine over tree automata techniques. Moreover we describe a generic graph rewriting engine in order to deal with classic mutations techniques. Finally, we provide a preliminary evaluation of the strategy detection carrying out experiments on a malware collection.

Copyright information

© Springer-Verlag France 2008

Authors and Affiliations

  • Guillaume Bonfante
    • 1
  • Matthieu Kaczmarek
    • 1
  • Jean-Yves Marion
    • 1
  1. 1.Nancy-Université, Loria, INPL, Ecole Nationale Supérieure des Mines de NancyVandœuvre-lès-Nancy CédexFrance