Static Analysis of Binary Code to Isolate Malicious Behaviors

In this paper, we address the problem of static slicing on binary executables for the purposes of the malicious code detection in COTS components. By operating directly on binary code without any assumption on the availability of source code, our approach is realistic and appropriate for the analysis of COTS software products. To be able to reason on such low-level code, we need a suite of program transformations that aim to get a high level imperative representation of the code. The intention is to significantly improve the analysability while preserving the original semantics. Next, we apply slicing techniques to extract those code fragments that are critical from the security standpoint. Finally, these fragments are subjected to verification against behavioral specifications to statically decide whether they exhibit malicious behaviors or not.

• Type: Conference
• Year: 1999
• Where: WETICE
• Authors: J. Bergeron, Mourad Debbabi, M. M. Erhioui, Béchir Ktari
• Keywords: Binary Code, Code, Emerging Technology, Malicious Code Detection, WETICE 1999