Polymorphic Worm Detection Using Structural Information of Executables

By Christopher Krügel, Engin Kirda, Darren H. Mutz, William K. Robertson, Giovanni Vigna. International Symposium on Recent Advances in Intrusion Detection, 2005

433 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/26e8a3f450f5c974a98ef2353aeb692af5e553ec

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Detecting Unknown Network Attacks Using Language Models (2006, background): “For misuse detection, it centers around the issues of making signatures more generic – and capable of at least not to be fooled by mutations of known attacks (3; 4; 5; 6; 7; 8).”
Classification of malware using structured control flow (2010, background): “Identifying common subgraphs of fixed sizes can also indicate similarity and has better performance (Kruegel et al. 2006).”
Structural detection of android malware using embedded call graphs (2013, methodology): “[27] as well as Cesare and Xiang [6] present methods for polymorphic malware detection based on the comparison of control flow graphs.”
Towards automatic generation of vulnerability-based signatures (2006, background): “The task of automatically constructing signatures is complicated by the fact that there are usually several different polymorphic exploit variants that can trigger a software vulnerability [21, 33, 43].”
Asm2Vec: Boosting Static Representation Robustness for Binary Clone Search against Code Obfuscation and Compiler Optimization (2019, methodology): “The idea of using Graphlet originated from [23].”
Opcodes as predictor for malware (2007, methodology): “In an exemplary exposition for the purposes of worm detection (Kruegel et al., 2005) extracted control flow graphs from executable code in network streams, augmented them with a colouring scheme, identified k-connected subgraphs that were subsequently used as structural fingerprints.”
Advanced Allergy Attacks: Does a Corpus Really Help? (2007, positive): “For example, the approaches in [12,8] generate signatures to match packets that contain sets/sequences of “tokens” (byte sequences), while [7] outputs signatures that identify bytes corresponding to certain control structures commonly found in suspicious traffic.”
Allergy Attack Against Automatic Signature Generation (2006, methodology): “Krugel et al in [6] try to identify executable payload in worm packets, and extract common properties in their control-flow graph as worm signatures.”
Effective and Efficient Malware Detection at the End Host (2009, methodology): “Another property is the control flow graph (CFG) of an application, which was used to detect polymorphic variants of malicious code instances that all share the same CFG structure [8, 24].”
Detection of Intrusions and Malware, and Vulnerability Assessment (2013, methodology): “The initial reply stated that it was a customer’s server and that according to the Dutch Notice and Take-down Code of Conduct [15], we had to notify the customer directly.”
Anagram: A Content Anomaly Detector Resistant to Mimicry Attack (2006, methodology): “, [5-8]) have focused on payload-based anomaly detection.”
Limits of Learning-based Signature Generation with Adversaries (2008, background): “Signature generation algorithms that use semantic information have taken many different directions; some examples to point at directions are [4, 8, 12, 19 , 31].”
Hamsa: fast signature generation for zero-day polymorphic worms with provable attack resilience (2006, methodology): “Recently, there has been active research on polymorphic worm signature generation and the related polymorphic worm and vulnerability study [4, 13, 14, 16, 26, 31].”
Graph-based malware detection using dynamic analysis (2011, background): “Classification based on control flow graphs generally uses sub-graph matching [5,20] or edit-distance between graphs [8].”