The Art of Computer Virus Research and Defense

By Peter Szor. 2005

1,012 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/c6df5556cecd7f9f615e084667c8606a78a9c3df

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Secure in-VM monitoring using hardware virtualization (2009, methodology): “The design of Lares enables complex and large security tools such as Antivirus programs [20] or intrusion detection systems to run on the security VM.”
A Comprehensive Review on Malware Detection Approaches (2020, methodology): “Malware usually changes the entry point of a program, so that malicious code being executed before the actual code [11].”
A Survey on Machine Learning Techniques for Cyber Security in the Last Decade (2020, background): “Since the inception of the ﬁrst computer virus in 1970, there is a race between cybercriminals and defenders [12].”
Smashing the Gadgets: Hindering Return-Oriented Programming Using In-place Code Randomization (2012, methodology): “Metamorphic transformations [35] can shift gadgets from their original offsets and alter many of their instructions, rendering them unusable.”
Exploring Multiple Execution Paths for Malware Analysis (2007, background): “In particular, this is true for self-modifying programs that use polymorphic or metamorphic techniques [27].”
Opcode sequences as representation of executables for data-mining-based unknown malware detection (2013, methodology): “Another solution is to use concrete unpacking routines to recover the actual payload that requires one routine per packing algorithm [75].”
Opcodes as predictor for malware (2007, methodology): “…generally do not use encryption, but are able to mutate their body in subsequent generation using various techniques, such as junk insertion, semantic NOPs, code transposition, equivalent instruction substitution and register reassignments (Christodorescu and Jha, 2003; Szor, 2005, pp.256–270).”
Effective and Efficient Malware Detection at the End Host (2009, methodology): “Using code polymorphism and obfuscation, malware programs can alter their appearance while keeping their behavior (functionality) unchanged [10, 46].”
Android permissions: a perspective combining risks and benefits (2012, methodology): “To achieve this, static analysis involves various binary forensic techniques, including decompilation, decryption, pattern matching [24] and static system call analysis [21].”
Ether: malware analysis via hardware virtualization extensions (2008, methodology): “Traditionally, anti-virus scanners have used simple emulation and API virtualization in their scanning engines [42].”
A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions (2016, background): “First, stub-saving without corrupting memory is inherently difficult [26].”
Learning and Classification of Malware Behavior (2008, background): “While static analysis o«ers a significant improvement in malware detection accuracy compared to traditional pattern matching, its main weakness lies in the diAEculty to handle obfuscated and self-modifying code [34].”
Dynamic Analysis of Malicious Code (2006, background): “In particular, this is true for self-modifying programs that use polymorphic [22, 26] and metamorphic [22] techniques and packed executables that unpack themselves during run-time [16].”