
A malware detector is a system that attempts to determine whether a program has malicious intent. In order to evade detection, malware writers (hackers) frequently use obfuscation to morph malware. Malware detectors that use a pattern-matching approach (such as commercial virus scanners) are susceptible to obfuscations used by hackers. The fundamental deficiency in the pattern-matching approach to malware detection is that it is purely syntactic and ignores the semantics of instructions. In this paper, we present a malware-detection algorithm that addresses this deficiency by incorporating instruction semantics to detect malicious program traits. Experimental evaluation demonstrates that our malware-detection algorithm can detect variants of malware with a relatively low run-time overhead. Moreover our semantics-aware malware detection algorithm is resilient to common obfuscations used by hackers.
Other information and computing sciences not elsewhere classified, 90699 Electrical and Electronic Engineering not elsewhere classified, Digital processor architectures, Electrical engineering not elsewhere classified, FOS: Electrical engineering, electronic engineering, information engineering, Software engineering not elsewhere classified, Computer Engineering
Other information and computing sciences not elsewhere classified, 90699 Electrical and Electronic Engineering not elsewhere classified, Digital processor architectures, Electrical engineering not elsewhere classified, FOS: Electrical engineering, electronic engineering, information engineering, Software engineering not elsewhere classified, Computer Engineering
| selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | 426 | |
| popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network. | Top 1% | |
| influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | Top 0.1% | |
| impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network. | Top 1% |
