Static Analysis of Executables to Detect Malicious Patterns

By Mihai Christodorescu, Somesh Jha. 2003

775 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Software, Privacy & Security, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Software

In Privacy & Security

In Signal Processing

Citations in the corpus

Towards the Science of Security and Privacy in Machine Learning (2016, background): “The training data comprises a set of labeled instances, each an executable clearly marked as malicious or benign [17].”
SoK: Security and Privacy in Machine Learning (2018, background): “executables) and categorical outputs (this binary task only has two possible classes). The training data comprises a set of labeled instances, each an executable clearly marked as malicious or benign [17]. Second, consider the task of extracting a pattern representative of normal activity in a compu”
Recovering clear, natural identifiers from obfuscated JS names (2017, background): “This has great relevance for malicious code detection [10, 32], and has received a great deal of attention.”
Learning to detect malicious executables in the wild (2004, background): “Then, in Section 6, we present empirical results, and in Section 7, we discuss these results and other approaches.”
Limits of Static Analysis for Malware Detection (2007, background): “Recent work [2] has demonstrated that techniques such as polymorphism and metamorphism are successful in evading commercial virus scanners.”
Evaluation and Design of Robust Neural Network Defenses (2018, methodology): “In the space of malware, machine learning has been used to detect malware from benign files [21, 104, 20, 29, 60, 108] (even using neural networks [24]) and an equal amount of work has been performed on attacking such classifiers [75, 134, 89, 92].”
PiOS: Detecting Privacy Leaks in iOS Applications (2011, background): “Christodorescu and Jha [6] present a static analyzer for executables that is geared towards detecting malicious patterns in binaries even if the content is obfuscated.”
Dynamic Analysis of Malicious Code (2006, background): “A number of static binary analysis techniques [2, 3, 8] have been introduced to detect different types of malware.”
Learning to Detect and Classify Malicious Executables in the Wild (2006, background): “Indeed, researchers have recently discovered that simple obfuscation techniques foil commercial programs for virus detection (Christodorescu and Jha, 2003).”
Exploring Multiple Execution Paths for Malware Analysis (2007, methodology): “In [8], a technique was introduced that uses model checking to identify parts of a program that implement a previously specified, malicious code template.”
A comparison of static, dynamic, and hybrid analysis for malware detection (2015, methodology): “In [11], the authors presented a malware detection technique that relies on static analysis and is based on control flow graphs.”
Learning and Classification of Malware Behavior (2008, methodology): “These techniques are especially e ffective against byte-level content analysis [17, 19] and static malware analysis methods [8, 10, 11].”
Automatic analysis of malware behavior using machine learning (2011, neutral): “These techniques are especially effective against static analysis of malicious binaries (e.g., [11,30,35,40,49]).”
Static Disassembly of Obfuscated Binaries (2004, methodology): “On the other hand, program obfuscation could also be used by attackers to hide malicious code such as viruses or Trojan Horses from virus scanners [3] [16].”
A Survey on Malware Detection Using Data Mining Techniques (2017, background): “The target of static analysis can be binary or source codes [Christodorescu and Jha 2003].”
Anagram: A Content Anomaly Detector Resistant to Mimicry Attack (2006, background): “Furthermore, signature scanners are vulnerable to zero-day exploits [3] and polymorphic worms/stealthy attacks with obfuscated exploit code [4].”
DUET: integration of dynamic and static analyses for malware clustering with cluster ensembles (2013, methodology): “Static features like PE headers [31], code patterns [7], instruction sequences [16] or binary sequences [15] are extracted and used to train various learning algorithms [19] for malware categorization and detection.”
Effective and Efficient Malware Detection at the End Host (2009, methodology): “On one hand, this has led to detectors [9, 12, 25] that use sophisticated static analysis to identify code that is semantically equivalent to a malware template.”
Machine Learning for Android Malware Detection Using Permission and API Calls (2013, methodology): “In comparisons, our work is motivated by some of the above techniques and approaches, but with focus on developing simple and effective malware detection approaches, without relying on complex dynamic runtime analysis and any static predefined malware signatures.”