Abstract:Our society is rapidly moving towards the digital age, which has led to a sharp increase in IoT networks and devices. This growth requires more network security professionals, who are focused on protecting IoT systems. One crucial task is to analyze malicious software to gain a deeper understanding of its functionalities and response methods. However, malware analysis is a complex process that requires the use of various analysis tools, including advanced reverse engineering techniques. For beginners, parsing complex binary data can be particularly challenging as they may be strange with these tools and the basic principles of analysis. Even for experienced analysts, understanding reverse engineering binary files and assembly lists is daunting.Facing these challenges, we propose a two-fold solution. Firstly, we create a detailed list of analysis tools and construct a malware analysis framework aimed at simplifying the analysis process. The framework will list the key data points that need to be addressed in the analysis, providing analysts with the tools and information needed for effective malware analysis. Secondly, we will demonstrate that advanced analysis techniques by providing analysis scripts which automate the reverse engineering process in malware analysis. To evaluate the accuracy of our behavior classification system, we will use our framework and analysis scripts to analyze known malware samples. Then, we will compare the accuracy of script-based analysis results and evaluate their ability to identify malicious software behavior. Our research results indicate that by following our framework and using our scripts, we can detect over 80% critical malware behaviors in known samples, which highlights the potential of simplifying the process of malware analysis, making it easier to learn and implement.

Component Similarity Based Methods for Automatic Analysis of Malicious Executables

Using a Fine-Grained Hybrid Feature for Malware Similarity Analysis.

The Similarity Analysis of Malicious Software

Detecting Malware Variants Via Function-Call Graph Similarity

Malware Analysis Using Machine Learning and Deep Learning Techniques

Technique of Detecting Malicious Executables Via Behavioral and Binary Signatures

Discovering Malicious Signatures in Software from Structural Interactions

A FEATURE SELECTION AND MODELLING METHOD FOR MALICIOUS CODE

Malicious Code Detection Based on Software Fingerprint

Misleading Malware Similarities Analysis By Automatic Data Structure Obfuscation

A Similarity Metric Method of Obfuscated Malware Using Function-Call Graph

Impeding Behavior-Based Malware Analysis Via Replacement Attacks to Malware Specifications

Automatic Malware Description via Attribute Tagging and Similarity Embedding

Design and Implementation of Malware Automated Analysis Tool Based on Behavior Analysis

Matching Similar Functions in Different Versions of a Malware

Feature Representation and Selection in Malicious Code Detection Methods Based on Static System Calls

Automatic Detection and Analysis Towards Malicious Behavior in IoT Malware

Malicious Code Detection Method Based on Static Features and Ensemble Learning

Android Malware Detection Using Local Binary Pattern and Principal Component Analysis.

AMCAS: an Automatic Malicious Code Analysis System

A Malicious Behavior Analysis Method Based on Program Semantic