Limits of Static Analysis for Malware Detection

By Andreas Moser, Christopher Krügel, Engin Kirda. 2007

975 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection (2017, background): “Notably, in this work we do not consider attacks that can completely defeat static analysis [31], like those based on packer-based encryption [47] and advanced code obfusca-”
Deep neural network based malware detection using two dimensional binary program features (2015, background): “In principle, dynamic detection can provide direct observation of malware action, is less vulnerable to obfuscation [30], and makes it harder to recycle existing malware.”
Intriguing Properties of Adversarial ML Attacks in the Problem Space (2019, methodology): “We achieve this by relying on opaque predicates [51], i.”
BitShred: feature hashing malware for scalable triage and semantic analysis (2011, neutral): “, [12, 13, 28, 29, 33, 35].”
MARVIN: Efficient and Comprehensive Mobile App Classification through Static and Dynamic Analysis (2015, background): “As research on x86 malware showed [46], static analysis techniques are prone to evasion”
A survey on automated dynamic malware-analysis techniques and tools (2012, background): “Software that deliberately ful.lls the harmful intent of an attacker is commonly referred to as malicious software or malware [Moser et al. 2007a].”
A Survey on Malware Detection Using Data Mining Techniques (2017, background): “Moser et al. [2007] discussed the drawbacks of static analysis.”
Learning and Classification of Malware Behavior (2008, background): “Moreover, recent work of Moser et al. presents obfuscation techniques that are provably NP-hard for static analysis [25].”
The Evolution of Android Malware and Android Analysis Techniques (2017, methodology): “These transformations have long been the downfall of static analysis frameworks for traditional analyses [Moser et al. 2007] and mobile malware analysis [Rastogi et al. 2013; Hoffmann et al. 2013].”
Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification (2015, background): “Although the implementation of calls depends both on the architecture, and on the optimal decision of compiler, indirect calls may reveal some information on data location obfuscation [33].”
Malware Analysis and Classification: A Survey (2014, background): “[12], explored the drawbacks of static analysis methodology.”
Evaluation and Design of Robust Neural Network Defenses (2018, methodology): “In the space of malware, machine learning has been used to detect malware from benign files [21, 104, 20, 29, 60, 108] (even using neural networks [24]) and an equal amount of work has been performed on attacking such classifiers [75, 134, 89, 92].”
Mobile-sandbox: having a deeper look into android applications (2013, background): “In response to static analysis systems in the desktop PC world, malware authors developed various obfuscation techniques that have have proven their effectiveness against static analysis [17, 24].”
An Android Application Sandbox system for suspicious software detection (2010, background): “Due to its nature, static analysis has an advantage of being fast and relatively simple [17].”
Effective and Efficient Malware Detection at the End Host (2009, background): “While generic unpackers [40] can sometimes help to obtain the actual instructions, binary analysis of obfuscated code is still very difficult [30].”
Automatic analysis of malware behavior using machine learning (2011, neutral): “Although simple obfuscation may be compensated to a certain degree, the generic analysis of obfuscated code can be shown to be NP-hard [40].”
Detection of Malicious Code Variants Based on Deep Learning (2018, methodology): “However, the static method is easily deceived by obfuscation techniques [18].”
Scalable, Behavior-Based Malware Clustering (2009, background): “Dynamic malware analysis systems have become increasingly popular because they deliver good analysis results even in case of obfuscated or self-modifying code and analysis resistance techniques [34, 38, 44].”