Concurrent Architecture for Automated Malware Classification

This paper introduces a new architecture for automating the generalization of program structure and the recognition of common patterns in the area of malware analysis. By using massively parallel processing on large malware program sets we can recognize common code sequences, such as loop constructs, if-then-else structures, and subroutine calls. We can also recognize common subroutine sequences. The Concordia architecture generalizes the recognized elements so they can be collected into invariant forms. The invariant forms can be used by the analyst to understand the program being analyzed. The invariant forms can also be used to classify large numbers of programs automatically. Motivation Current practice in malware analysis uses our most expensive resource, namely the analyst, to analyze programs one at a time. The large volume of malicious programs is rapidly overwhelming our ability to analyze malware in a timely manner. The analyst has few tools to automatically classify a parti...

• Type: Conference
• Year: 2010
• Where: HICSS
• Authors: Timothy Daly, Luanne Burns
• Keywords: Biometrics, HICSS 2010, Invariant Forms, Malware, Malware Analysis, System Sciences