Testing malware detectors

By Mihai Christodorescu, Somesh Jha. International Symposium on Software Testing and Analysis, 2004

354 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/92964aa27979c328bd065f00d60d4da586ec8ea9

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Software

In Signal Processing

Citations in the corpus

Detection of Intrusions and Malware, and Vulnerability Assessment (2012, background): “This result is unsurprising given that Google has been vigilant about removing malware once it is found, banning the associated account, and issuing remote removal[15].”
Detection of malicious code by applying machine learning classifiers on static features: A state-of-the-art survey (2009, methodology): “After parsing the text and extracting the words it includes, a vocabulary of the entire word collection is constructed.”
DroidChameleon: evaluating Android anti-malware against transformation attacks (2013, background): “Christodorescu and Jha [8] conducted a study similar to ours on desktop anti-malware applications nine years ago.”
Semantics-aware malware detection (2005, background): “A recent study demonstrated that such malware detectors can be easily defeated using simple program obfuscations [8], that are already being used by hackers.”
Opcode sequences as representation of executables for data-mining-based unknown malware detection (2013, background): “…include garbage insertion , which consists on adding sequences which do not modify the behaviour of the program (e.g., nop instructions 1 ); code reordering , which changes the order of program instructions and variable renaming ; which replaces a variable identiﬁer with another one [15].”
Reviewer Integration and Performance Measurement for Malware Detection (2015, background): “iate when the underlying data does not “drift” between training and testing time. Unfortunately, this requirement is violated for malware detection, where attackers try to evade the antivirus systems [9,32] or simply upgrade malware in functionality. Indeed, prior work suggests that cross-validation”
PolyUnpack: Automating the Hidden-Code Extraction of Unpack-Executing Malware (2006, background): “In 2004, however, Christodorescu and Jha demonstrated in [2] that encapsulation techniques used in modern polymorphic viruses prevented commercial anti-virus products from detecting otherwise functionally identical variants of known malware.”
Effective and Efficient Malware Detection at the End Host (2009, background): “Using code polymorphism and obfuscation, malware programs can alter their appearance while keeping their behavior (functionality) unchanged [11, 46].”
A Survey of Malware Detection Techniques (2007, background): “For instance, Christodorescu and Jha [11] describe a malware instance as a program whose objective is malevolent .”