Limits of Static Analysis for Malware Detection

Malicious code is an increasingly important problem that threatens the security of computer systems. The traditional line of defense against malware is composed of malware detectors such as virus and spyware scanners. Unfortunately, both researchers and malware authors have demonstrated that these scanners, which use pattern matching to identify malware, can be easily evaded by simple code transformations. To address this shortcoming, more powerful malware detectors have been proposed. These tools rely on semantic signatures and employ static analysis techniques such as model checking and theorem proving to perform detection. While it has been shown that these systems are highly effective in identifying current malware, it is less clear how successful they would be against adversaries that take into account the novel detection mechanisms. The goal of this paper is to explore the limits of static analysis for the detection of malicious code. To this end, we present a binary obfuscation...

• Type: Conference
• Year: 2007
• Where: ACSAC
• Authors: Andreas Moser, Christopher Kruegel, Engin Kirda
• Keywords: ACSAC 2007, Malware Detectors, Opaque Constant, Security Privacy, Static Analysis