SPiKE: engineering malware analysis tools using unobtrusive binary-instrumentation

Malware — a generic term that encompasses viruses, trojans, spywares and other intrusive code — is widespread today. Malware analysis is a multi-step process providing insight into malware structure and functionality, facilitating the development of an antidote. Behavior monitoring, an important step in the analysis process, is used to observe malware interaction with respect to the system and is achieved by employing dynamic coarse-grained binary-instrumentation on the target system. However, current research involving dynamic binary-instrumentation, categorized into probebased and just-in-time compilation (JIT), fail in the context of malware. Probe-based schemes are not transparent. Most if not all malware are sensitive to code modification incorporating methods to prevent their analysis and even instrument the system themselves for their functionality and stealthness. Current JIT schemes, though transparent, do not support multithreading, selfmodifying and/or self-checking (S...

• Type: Conference
• Year: 2006
• Where: ACSC
• Authors: Amit Vasudevan, Ramesh Yerraballi
• Keywords: ACSC 2006, Computer Science, Dynamic Coarse-grained Binary-instrumentation, Malware, Malware Analysis