HERO: A Novel Malware Detection Framework based on Binary Translation

摘要：

Malware has become one of the most serious threats to computer information system. In this paper, we describe HERO (Hybrid sEcurity extension of binaRy translatiOn), a novel framework that exploits static and dynamic binary translation features to detect broad spectrum malware and prevent its execution. By operating directly on binary code without any assumption on the availability of source code, HERO is appropriate for translating low-level binary code to high-level proper representation, obtaining CFG (Control Flow Graph) and other high-level Control Structure by static binary translation-based analyzer. Then Critical API Graph based on CFG is generated to do sub-graph matching with the defined Malware Behavior Template. If static analysis cannot finish generating CFG because of code obfuscation used in malware, the dynamic binary translation based analyzer in HERO is called to undertake the process to take on the remaining code analysis. Compared with other detection approaches, HERO is found to be very efficient in terms of detection capability and false alarm rate.

关键词： Mahvare Detection Binary Translation Critical API Graph Code Analysis Information Security

作者: Haoran Guo Jianmin Pang Yichi Zhang Feng Yue Rongcai Zhao

作者单位: National Digital Switching System Engineering & Technology Research Center Postbox 1001 No.717, Zhen National Digital Switching System Engineering & Technology Research Center Postbox 1001 No.717,Zheng National Digital Switching System Engineering & Technology Research Center Postbox 1001 No.717, Zhen

会议类型: 国际会议

会议名称: 2010 IEEE International Conference on Intelligent Computing and Intelligent Systems(2010 IEEE 智能计算与智能系统国际会议 ICIS 2010)

会议地点: 厦门

会议语种:英文

页码: 411-415

在线出版日期: 2010-10-29（万方平台首次上网日期，不代表论文的发表时间）