TY - GEN
T1 - Semantically non-preserving transformations for antivirus evaluation
AU - Ersan, Erkan
AU - Malka, Lior
AU - Kapron, Bruce M.
N1 - Publisher Copyright:
© Springer International Publishing AG 2017.
PY - 2017/1/1
Y1 - 2017/1/1
N2 - We relax the notion of malware obfuscation to include semantically non-preserving transformations. Unlike traditional obfuscation techniques, these transformation may not preserve original code behaviour. Using web-based malware we focus on transformations which modify abstract syntax trees. While such transformations yield syntactically valid programs, they may yield dysfunctional samples, so that it is not clear that this is a practical approach to producing detection-evading malware. However, by implementing an automated system that efficiently filters dysfunctional samples on a virtual cloud architecture, we show that such transformations are in fact practical. Using two simple transformations, we evaluated four antivirus products and were able to create many samples that evade detection, demonstrating that semantic-preserving obfuscation is not the only effective way to mutate malware.
AB - We relax the notion of malware obfuscation to include semantically non-preserving transformations. Unlike traditional obfuscation techniques, these transformation may not preserve original code behaviour. Using web-based malware we focus on transformations which modify abstract syntax trees. While such transformations yield syntactically valid programs, they may yield dysfunctional samples, so that it is not clear that this is a practical approach to producing detection-evading malware. However, by implementing an automated system that efficiently filters dysfunctional samples on a virtual cloud architecture, we show that such transformations are in fact practical. Using two simple transformations, we evaluated four antivirus products and were able to create many samples that evade detection, demonstrating that semantic-preserving obfuscation is not the only effective way to mutate malware.
UR - https://www.scopus.com/pages/publications/85009511183
U2 - 10.1007/978-3-319-51966-1_18
DO - 10.1007/978-3-319-51966-1_18
M3 - Conference contribution
AN - SCOPUS:85009511183
SN - 9783319519654
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 273
EP - 281
BT - Foundations and Practice of Security - 9th International Symposium, FPS 2016, Revised Selected Papers
A2 - Garcia-Alfaro, Joaquin
A2 - Cuppens, Frederic
A2 - Cuppens-Boulahia, Nora
A2 - Wang, Lingyu
A2 - Tawbi, Nadia
PB - Springer Verlag
T2 - 9th International Symposium on Foundations and Practice of Security, FPS 2016
Y2 - 24 October 2016 through 26 October 2016
ER -