Large-scale malware indexing using function-call graphs

By Xin Hu, Tzi-Cker Chiueh, Kang G. Shin. Conference on Computer and Communications Security, 2009

376 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/71d53e99d5cc2fcbc95eb57666b67f63663a26f6

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification (2015, background): “As far as a very high number of malware variants is concerned, the need for the automation of this process is clear-cut.”
Structural detection of android malware using embedded call graphs (2013, methodology): “Some of these methods rely on suboptimal strategies such as the graph edit distance [21] or the identification of maximum common subgraphs, while other ad hoc solutions propose the serialization of the graph structure [5] as a way to measure similarity.”
VAMO: towards a fully automated malware clustering validity analysis (2012, methodology): “In [8], Hu et al. perform malware clustering using static analysis, instead of behavior-based features, by leveraging function-call graphs, while [11] introduces a system called BitShred that aims to improve scalability in malware clustering systems.”
Graph Classification using Structural Attention (2018, background): “For instance, in the task of malware classification on function-call graphs the graphs have been known to contain up to ~37,000 nodes [13].”
Semantics-Aware Android Malware Classification Using Weighted Contextual API Dependency Graphs (2014, background): “sition to a hierarchical database structure, such as vantage point tree [20], under each bucket.”
Smashing the Gadgets: Hindering Return-Oriented Programming Using In-place Code Randomization (2012, background): “…Pro is effective in the identification of function boundaries, even for functions with non-contiguous code and extensive use of basic block sharing [48], and also takes advantage of the relocation information present in Windows DLLs. Typically, however, without the symbolic information of PDB…”
discovRE: Efficient Cross-Architecture Identification of Bugs in Binary Code (2016, methodology): “The CFG is an easily approachable structure and has been shown to be a good predictor for the labeling of binaries [29] and was hence selected as structural feature.”
Graph-based malware detection using dynamic analysis (2011, background): “Another line of research uses control flow graphs to categorize the behavior of the program [5,8,15,20].”
Detection of Intrusions and Malware, and Vulnerability Assessment (2013, background): “Previously, many types of malware features have been used to classify or cluster malware instances, such as byte sequence n-gram [31,12,25], instructions in execution traces [1], PE headers [34,26], function call graphs [8], control flow graphs [15], and system calls [11,4,6].”