Mining Network Behavior Specifications of Malware Based on Binary Analysis

摘要：

　　Nowadays,malware,especially for a botnet,heavily employs network communication to accomplish predefined malicious functionalities.The network behavior of malware attracts attention of researchers.However,the network traffic used for network-based signatures generation and botnet detection is captured passively from an execution environment,that there are several limitations.In this paper,we present a network behavior mining approach based on binary analysis,named NBSBA.Our goal is to accurately understand the network behavior of malware in details,capture the packets the malware sample under analysis launched as soon as possible,and extract network behavior of malware as completely as possible.We firstly give a network behavior specification and then describe the NBSBA.And we implement a prototype system to evaluate the NBSBA.The experiment demonstrates that our approach is efficient.

关键词： Network Behavior Binary Analysis Malware

作者: Peidai Xie Yongjun Wang Huabiao Lu

作者单位: College of Computer, National University of Defense Technology, Changsha Hunan, China

会议类型: 国内会议

会议名称: 第二届中国互联网学术年会

会议地点: 张家界

会议语种:英文

页码: 213-216

在线出版日期: 2013-07-01（万方平台首次上网日期，不代表论文的发表时间）