Exploring Multiple Execution Paths for Malware Analysis

By Andreas Moser, Christopher Krügel, Engin Kirda. IEEE Symposium on Security and Privacy, 2007

607 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/4dcd5ca0ba7aac6c08f8b657e5b889a908c78ea1

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Software

In Signal Processing

Citations in the corpus

CopperDroid: Automatic Reconstruction of Android Malware Behaviors (2015, methodology): “then any dynamic analysis would fail unless proper, but generally expensive and complex exploration techniques are adopted [8], [31].”
Panorama: capturing system-wide information flow for malware detection and analysis (2007, unknown): “[24] and Brumley et al.”
DUET: integration of dynamic and static analyses for malware clustering with cluster ensembles (2013, background): “Countermeasures include use of more transparent environments [8, 9], detecting split identities of malware samples [5] and forcing multiple path exploration [26].”
Learning and Classification of Malware Behavior (2008, background): “[23], which essentiall y tracks input to a running binary and selects a feasible subset of possible execution paths.”
Vetting undesirable behaviors in android apps with permission use analysis (2013, methodology): “The Application Driver could be enhanced with an automatic input generation system such as AppsPlayground [48], AppInspector [34], Dynodroid [43], or guided analysis technique such as multi-path exploration [44], forced/informed execution [54,55].”
Dynamic Malware Analysis in the Modern Era—A State of the Art Survey (2019, methodology): “Multiple path exploration [63, 64] is a mechanism used to force the execution of all of the malware’s code, which is based on the concept of executing both paths of a selected condition.”
DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis (2012, methodology): “In particular, much work has leveraged virtualization techniques, either whole-system software emulation or hardware virtualization, to introspect and analyze illicit activities within the virtual machine [11, 15, 18, 31, 33, 39, 37].”
Aurasium: Practical Policy Enforcement for Android Applications (2012, unknown): “Techniques such as multipath exploration [31]”
Towards an understanding of anti-virtualization and anti-debugging behavior in modern malware (2008, methodology): “Another interesting approach [24] is to take advantage of virtualization — manipulating memory objects during run-time to exploit multiple execution paths of malware and building a full view of the malware behavior.”
Automated Classification and Analysis of Internet Malware (2007, unknown): “[21].”
All Your iFRAMEs Point to Us (2008, background): “Lastly, malware detection via dynamic tainting analysis may provide deeper insight into the mechanisms by which malware installs itself and how it operates [10, 15, 27].”
BitShred: feature hashing malware for scalable triage and semantic analysis (2011, unknown): “, [12, 13, 28, 29, 33, 35].”
DTA++: Dynamic Taint Analysis with Targeted Control-Flow Propagation (2011, background): “However, a significant limitation of standard approaches to DTA is that they do not propagate taint along control dependencies (also called implicit flows): parts of a program where tainted data values affect control flow, and then the control flow variation affects other data.”
Large-scale malware classification using random projections and neural networks (2013, methodology): “The API tri-gram and API parameter features are used to analyze the dynamic behavior of the unknown file [6, 7].”