Abstract:As the underground market of malware flourishes, there is an exponential increase in the number and diversity of malware. A crucial question in malware analysis research is how to define malware specifications or signatures that faithfully describe similar malicious intent and also clearly stand out from other programs. Although the traditional malware specifications based on syntactic signatures are efficient, they can be easily defeated by various obfuscation techniques. Since the malicious behavior is often stable across similar malware instances, behavior-based specifications which capture real malicious characteristics during run time, have become more prevalent in anti-malware tasks, such as malware detection and malware clustering. This kind of specification is typically extracted from the system call dependence graph that a malware sample invokes. In this paper, we present replacement attacks to camouflage similar behaviors by poisoning behavior-based specifications. The key method of our attacks is to replace a system call dependence graph to its semantically equivalent variants so that the similar malware samples within one family turn out to be different. As a result, malware analysts have to put more efforts into reexamining the similar samples which may have been investigated before. We distil general attacking strategies by mining more than 5200 malware samples’ behavior specifications and implement a compiler-level prototype to automate replacement attacks. Experiments on 960 real malware samples demonstrate the effectiveness of our approach to impede various behavior-based malware analysis tasks, such as similarity comparison and malware clustering. In the end, we also discuss possible countermeasures in order to strengthen existing malware defense.

Method of Malware Behavior Analysis in Disassembly Level

FMDiv: Functional Module Division on Binary Malware for Accurate Malicious Code Localization.

Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART.

Design and Implementation of Malware Automated Analysis Tool Based on Behavior Analysis

Dynamic Analysis of Malicious Code

Impeding Behavior-Based Malware Analysis Via Replacement Attacks to Malware Specifications

A New Approach to Malware Detection

Malicious code detection in android: the role of sequence characteristics and disassembling methods

Analysis of Abnormity Return in Subprogram from Malicious Executables

Malware Analysis Using Machine Learning and Deep Learning Techniques

A malware detection framework based on kolmogorov complexity

A Function Call Graph Extraction Method Combining Static and Dynamic Analysis

Design and Implementation of an Automated Malware Dynamic Analysis System

Misleading Malware Similarities Analysis By Automatic Data Structure Obfuscation

APPROACH FOR DETECTING ANTI-ANALYSIS MALWARE

Malware Detection in Adversarial Settings

MALDC: a depth detection method for malware based on behavior chains

Mwsandbox: On Improving The Efficiency Of Automated Coarse-Grained Dynamic Malware Analysis

Behavior-Based Malware Analysis and Detection

Component Similarity Based Methods for Automatic Analysis of Malicious Executables

Unmasking the Shadows: Pinpoint the Implementations of Anti-Dynamic Analysis Techniques in Malware Using LLM