恶意代码行为描述与分析综述

喻波; 方莹; 杨强; 唐勇; 刘浏

doi:10.1631/FITEE.1601745

Your Location：

Home >

Browse articles >

恶意代码行为描述与分析综述

常规文章 | Updated：2022-05-19

- 恶意代码行为描述与分析综述
- A survey of malware behavior description and analysis
- 信息与电子工程前沿（英文） 2018年19卷第5期页码：583-603
- Affiliations：
  
  College of Computer, National University of Defense Technology, Changsha 410073, China
- Author bio：
  
  Bo YU, E-mail: yubo0615@nudt.edu.cn
  [ "Ying FANG, E-mail: fangying15@nudt.edu.cn" ]
  [ "Qiang YANG, E-mail: q.yang@nudt.edu.cn" ]
  [ "Yong TANG, E-mail: ytang@nudt.edu.cn" ]
  [ "Liu LIU, E-mail: hotmailliuliu@163.com" ]
- Funds：
  
  Project supported by the National Natural Science Foundation of China (No. 61472437)
- DOI：10.1631/FITEE.1601745
  中图分类号： TP309.5
- 收稿：2016-11-26，
  
  修回：2018-;5-;8，
  
  纸质出版：2018-05
- Accepted：
Scan QR Code
喻波, 方莹, 杨强, 等. 恶意代码行为描述与分析综述[J]. 信息与电子工程前沿（英文）, 2018,19(5):583-603.

Bo YU, Ying FANG, Qiang YANG, et al. A survey of malware behavior description and analysis[J]. Frontiers of Information Technology & Electronic Engineering, 2018, 19(5): 583-603.
喻波, 方莹, 杨强, 等. 恶意代码行为描述与分析综述[J]. 信息与电子工程前沿（英文）, 2018,19(5):583-603. DOI： 10.1631/FITEE.1601745.

Bo YU, Ying FANG, Qiang YANG, et al. A survey of malware behavior description and analysis[J]. Frontiers of Information Technology & Electronic Engineering, 2018, 19(5): 583-603. DOI： 10.1631/FITEE.1601745.

摘要

基于行为的分析是恶意代码自动分析和检测过程中的一项重要技术，近年来得到学术界和工业界极大关注。恶意代码行为分析技术，能够避免传统静态分析技术遇到的恶意代码混淆的障碍，也能够通过行为描述规范表达恶意代码样本多样化的行为类型。目前，虽有一些关注恶意代码行为分析的工作，但基于行为的恶意代码分析技术仍未成熟，目前尚未发现介绍当前研究进展和发展挑战的综述。本文从3个方面对恶意代码的行为描述和分析进行综述：恶意代码行为描述，恶意代码行为分析模型，可视化。首先，全面梳理了现有行为分析技术的分析目标、原则、特点和分类，包括现有行为数据类型和描述方法；其次，从多方面分析恶意代码分析的不足和挑战；最后，探讨了潜在研究热点。

Abstract

Behavior-based malware analysis is an important technique for automatically analyzing and detecting malware

and it has received considerable attention from both academic and industrial communities. By considering how malware behaves

we can tackle the malware obfuscation problem

which cannot be processed by traditional static analysis approaches

and we can also derive the as-built behavior specifications and cover the entire behavior space of the malware samples. Although there have been several works focusing on malware behavior analysis

such research is far from mature

and no overviews have been put forward to date to investigate current developments and challenges. In this paper

we conduct a survey on malware behavior description and analysis considering three aspects: malware behavior description

behavior analysis methods

and visualization techniques. First

existing behavior data types and emerging techniques for malware behavior description are explored

especially the goals

principles

characteristics

and classifications of behavior analysis techniques proposed in the existing approaches. Second

the inadequacies and challenges in malware behavior analysis are summarized from different perspectives. Finally

several possible directions are discussed for future research.

关键词

Keywords

references

S Alam , , , RN Horspool , , , I Traore , , , 等 . . A framework for metamorphic malware analysis and real-time detection . . Comput Secur , , 2015 . . 48 212 - - 233 . . DOI: 10.1016/j.cose.2014.10.011 http://doi.org/10.1016/j.cose.2014.10.011 . .

M Alazab . . Profiling and classifying the behavior of malicious codes . . J Syst Softw , , 2015 . . 100 91 - - 102 . . DOI: 10.1016/j.jss.2014.10.031 http://doi.org/10.1016/j.jss.2014.10.031 . .

M Alazab , , , S Venkataraman , , , P Watters . . Towards Understanding malware behaviour by the extraction of API calls . . Proc 2 nd Cybercrime and Trustworthy Computing Workshop , , 2010 . . p.52 - - 59 . . DOI: 10.1109/CTC.2010.8 http://doi.org/10.1109/CTC.2010.8 . .

B Anderson , , , C Storlie , , , T Lane . . Improving malware classification: Bridging the static/dynamic gap . . Proc 5 th ACM Workshop on Security and Artificial Intelligence , , 2012 . . p.3 - - 14 . . DOI: 10.1145/2381896.2381900 http://doi.org/10.1145/2381896.2381900 . .

B Anderson , , , T Lane , , , C Hash . . Malware phylogenetics based on the multiview graphical lasso . . Proc 13 th Int Symposium on Advances in Intelligent Data Analysis XIII , , 2014 . . p.1 - - 12 . . DOI: 10.1007/978-3-319-12571-8_1 http://doi.org/10.1007/978-3-319-12571-8_1 . .

D Arp , , , M Spreitzenbarth , , , M Hübner , , , 等 . . DREBIN: effective and explainable detection of Android malware in your pocket . . Proc 17 th Network and Distributed System Security Symp , , 2014 . . p.1 - - 16 . . DOI: 10.14722/ndss.2014.23247 http://doi.org/10.14722/ndss.2014.23247 . .

D Babić , , , D Reynaud , , , DW Song . . Malware analysis with tree automata inference . . Proc 23 rd Int Conf on Computer Aided Verification , , 2011 . . p.116 - - 131 . . DOI: 10.1007/978-3-642-22110-1_10 http://doi.org/10.1007/978-3-642-22110-1_10 . .

D Babić , , , D Reynaud , , , DW Song . . Recognizing malicious software behaviors with tree automata inference . . Form Methods Syst Des , , 2012 . . 41 ( ( 1 ): ): 107 - - 128 . . DOI: 10.1007/s10703-012-0149-1 http://doi.org/10.1007/s10703-012-0149-1 . .

M Bailey , , , J Oberheide , , , J Andersen , , , 等 . . Automated classification and analysis of Internet malware . . Proc 10 th Int Symp on Recent Advances in Intrusion Detection , , 2007 . . p.178 - - 197 . . DOI: 10.1007/978-3-540-74320-0_10 http://doi.org/10.1007/978-3-540-74320-0_10 . .

S Barnum . . . . Standardizing cyber threat intelligence information with the structured threat information eXpression (STIX TM ) , , 2012 . . .

E Bauman , , , G Ayoade , , , ZQ Lin . . A survey on hypervisor-based monitoring: approaches, applications, and evolutions . . ACM Comput Surv , , 2015 . . 48 ( ( 1 ): ): Article 10 DOI: 10.1145/2775111 http://doi.org/10.1145/2775111 . .

U Bayer , , , C Kruegel , , , E Kirda . . TTAnalyze: a tool for analyzing malware . . Proc 15 th Annual Conf of the European Institute for Computer Antivirus Research , , 2006 . . p.180 - - 192 . . . .

U Bayer , , , PM Comparetti , , , C Hlauscheck , , , 等 . . Scalable, behavior-based malware clustering . . Proc 16 th Symp on Network and Distributed System Security , , 2009 . . p.1 - - 21 . . . .

U Bayer , , , I Habibi , , , D Balzarotti , , , 等 . . A view on current malware behaviors . . Proc 2 nd USENIX Conf on Large-Scale Exploits and Emergent Threats: Botnets, Spyware, Worms, and More , , 2014 . . p.8 . .

P Beaucamps , , , I Gnaedig , , , JY Marion . . Behavior abstraction in malware analysis . . Proc 1 st Int Conf on Runtime Verification , , 2010 . . p.168 - - 182 . . DOI: 10.1007/978-3-642-16612-9_14 http://doi.org/10.1007/978-3-642-16612-9_14 . .

P Beaucamps , , , I Gnaedig , , , JY Marion . . Abstraction-based malware analysis using rewriting and model checking . . Proc 17 th European Symp on Research in Computer Security , , 2012 . . p.806 - - 823 . . DOI: 10.1007/978-3-642-33167-1_46 http://doi.org/10.1007/978-3-642-33167-1_46 . .

M Belaoued , , , S Mazouzi . . A real-time pe-malware detection system based on CHI-square test and pe-file features . . Proc 5 th IFIP TC 5 Int Conf on Science and Its Applications , , 2015 . . p.416 - - 425 . . DOI: 10.1007/978-3-319-19578-0_34 http://doi.org/10.1007/978-3-319-19578-0_34 . .

B Biggio , , , K Rieck , , , D Ariu , , , 等 . . Poisoning behavioral malware clustering . . Proc Workshop on Artificial Intelligent and Security Workshop , , 2014 . . p.27 - - 36 . . DOI: 10.1145/2666652.2666666 http://doi.org/10.1145/2666652.2666666 . .

H Bos . . Analysis report of behavioral features . . http://www.wombat-project.eu/2010/07/wombat-deliverable-d16d42-anal.html http://www.wombat-project.eu/2010/07/wombat-deliverable-d16d42-anal.html , , 2013 . . .

D Brumley , , , C Hartwig , , , ZK Liang , , , 等 . . Automatically identifying trigger-based behavior in malware. In: Lee W, Wang C, Dagon D (Eds.), Botet Detection . . Springer, Boston, MA , , 2008 . . p.65 - - 88 . . DOI: 10.1007/978-0-387-68768-1_4 http://doi.org/10.1007/978-0-387-68768-1_4 . .

G Canfora , , , F Mercaldo , , , CA Visaggio . . An hmm and structural entropy based detector for Android malware: an empirical study . . Comput Secur , , 2016 . . 61 1 - - 18 . . DOI: 10.1016/j.cose.2016.04.009 http://doi.org/10.1016/j.cose.2016.04.009 . .

Y Cao , , , QG Miao , , , JC Liu , , , 等 . . Abstracting minimal security-relevant behaviors for malware analysis . . J Comput Virol Hack Tech , , 2013 . . 9 ( ( 4 ): ): 193 - - 204 . . DOI: 10.1007/s11416-013-0186-3 http://doi.org/10.1007/s11416-013-0186-3 . .

L Cen , , , CS Gates , , , L Si , , , 等 . . A probabilistic discriminative model for Android malware detection with decompiled source code . . IEEE Trans Depend Sec Comput , , 2015 . . 12 ( ( 4 ): ): 400 - - 412 . . DOI: 10.1109/TDSC.2014.2355839 http://doi.org/10.1109/TDSC.2014.2355839 . .

S Cesare , , , Y Xiang , , , WL Zhou . . Control flow-based malware variant detection . . IEEE Trans Depend Sec Comput , , 2014 . . 11 ( ( 4 ): ): 307 - - 317 . . DOI: 10.1109/TDSC.2013.40 http://doi.org/10.1109/TDSC.2013.40 . .

M Chandramohan , , , HBK Tan , , , LK Shar . . Scalable malware clustering through coarse-grained behavior modeling . . Proc ACM SIGSOFT 20 th Int Symp on the Foundations of Software Engineering , , 2012 . . article 27 DOI: 10.1145/2393596.2393627 http://doi.org/10.1145/2393596.2393627 . .

M Christodorescu , , , S Jha , , , C Kruegel . . Mining specifications of malicious behavior . . Proc 1 st India Software Engineering Conf , , 2008 . . p.5 - - 14 . . DOI: 10.1145/1342211.1342215 http://doi.org/10.1145/1342211.1342215 . .

HY Chuang , , , SD Wang . . Machine learning based hybrid behavior models for Android malware analysis . . Proc IEEE Int Conf on Software Quality, Reliability and Security , , 2015 . . p.201 - - 206 . . DOI: 10.1109/QRS.2015.37 http://doi.org/10.1109/QRS.2015.37 . .

PM Comparetti , , , G Salvaneschi , , , E Kirda , , , 等 . . Identifying dormant functionality in malware programs . . Proc IEEE Symp on Security and Privacy , , 2010 . . p.61 - - 76 . . DOI: 10.1109/SP.2010.12 http://doi.org/10.1109/SP.2010.12 . .

Cuckoo . . Cuckoo sandbox . . https://cuckoosandbox.org https://cuckoosandbox.org , , 2017 . . .

GE Dahl , , , JW Stokes , , , L Deng , , , 等 . . Large-scale malware classification using random projections and neural networks . . Proc IEEE Int Conf on Acoustics, Speech and Signal Processing , , 2013 . . p.3422 - - 3426 . . DOI: 10.1109/ICASSP.2013.6638293 http://doi.org/10.1109/ICASSP.2013.6638293 . .

A Damodaran , , , F di Troia , , , CA Visaggio , , , 等 . . A comparison of static, dynamic, and hybrid analysis for malware detection . . J Comput Virol Hack Tech , , 2017 . . 13 ( ( 1 ): ): 1 - - 12 . . DOI: 10.1007/s11416-015-0261-z http://doi.org/10.1007/s11416-015-0261-z . .

S Das , , , Y Liu , , , W Zhang , , , 等 . . Semantics-based online malware detection: towards efficient real-time protection against malware . . IEEE Trans Inform Forens Secur , , 2016 . . 11 ( ( 2 ): ): 289 - - 302 . . DOI: 10.1109/TIFS.2015.2491300 http://doi.org/10.1109/TIFS.2015.2491300 . .

N Deschamps . . Specification language for code behavior . . http://wombat-project.eu/WP4/FP7-ICT-216026-Wombat_WP4_D08_V01_Specification_language_for_code_behaviour.pdf , , 2008 . . .

A Dinaburg , , , P Royal , , , M Sharif , , , 等 . . Ether: malware analysis via hardware virtualization extensions . . Proc 15 th ACM Conf on Computer and Communications Security , , 2008 . . p.51 - - 62 . . DOI: 10.1145/1455770.1455779 http://doi.org/10.1145/1455770.1455779 . .

YX Ding , , , XB Yuan , , , K Tang , , , 等 . . A fast malware detection algorithm based on objective-oriented association mining . . Comput Secur , , 2013 . . 39 315 - - 324 . . DOI: 10.1016/j.cose.2013.08.008 http://doi.org/10.1016/j.cose.2013.08.008 . .

YX Ding , , , W Dai , , , SL Yan , , , 等 . . Control flow-based opcode behavior analysis for malware detection . . Comput Secur , , 2014 . . 44 65 - - 74 . . DOI: 10.1016/j.cose.2014.04.003 http://doi.org/10.1016/j.cose.2014.04.003 . .

T Dube , , , R Raines , , , G Peterson , , , 等 . . Malware target recognition via static heuristics . . Comput Secur , , 2012 . . 31 ( ( 1 ): ): 137 - - 147 . . DOI: 10.1016/j.cose.2011.09.002 http://doi.org/10.1016/j.cose.2011.09.002 . .

T Dumitras , , , I Neamtiu . . Experimental challenges in cyber security: a story of provenance and lineage for malware . . Proc 4 th Conf on Cyber Security Experimen-tation and Test , , 2011 . . p.9 . .

M Egele , , , T Scholte , , , E Kirda , , , 等 . . A survey on automated dynamic malware-analysis techniques and tools . . ACM Comput Surv , , 2012 . . 44 ( ( 2 ): ): Article 6 DOI: 10.1145/2089125.2089126 http://doi.org/10.1145/2089125.2089126 . .

AAE Elhadi , , , MA Maarof , , , BIA Barry , , , 等 . . Enhancing the detection of metamorphic malware using call graphs . . Comput Secur , , 2014 . . 46 62 - - 78 . . DOI: 10.1016/j.cose.2014.07.004 http://doi.org/10.1016/j.cose.2014.07.004 . .

Y Feng , , , S Anand , , , I Dillig , , , 等 . . Apposcopy: semantics-based detection of Android malware through static analysis . . Proc 22 nd ACM SIGSOFT Int Symp on Foundations of Software Engineering , , 2014 . . p.576 - - 587 . . DOI: 10.1145/2635868.2635869 http://doi.org/10.1145/2635868.2635869 . .

Y Feng , , , O Bastani , , , R Martins , , , 等 . . Automated synthesis of semantic malware signatures using maximum satisfiability . . Proc Network and Distributed System Security Symp , , 2017 . . p.1 - - 16 . . DOI: 10.14722/ndss.2017.23379 http://doi.org/10.14722/ndss.2017.23379 . .

Y Fratantonio , , , A Bianchi , , , W Robertson , , , 等 . . Triggerscope: towards detecting logic bombs in Android applications . . Proc IEEE Symp on Security and Privacy , , 2016 . . p.377 - - 396 . . DOI: 10.1109/SP.2016.30 http://doi.org/10.1109/SP.2016.30 . .

M Fredrikson , , , S Jha , , , M Christodorescu , , , 等 . . Synthesizing near-optimal malware specifications from suspicious behaviors . . Proc IEEE Symp on Security and Privacy , , 2010 . . p.45 - - 60 . . DOI: 10.1109/SP.2010.11 http://doi.org/10.1109/SP.2010.11 . .

HS Galal , , , YB Mahdy , , , MA Atiea . . Behavior-based features model for malware detection . . J Comput Virol Hack Tech , , 2016 . . 12 ( ( 2 ): ): 59 - - 67 . . DOI: 10.1007/s11416-015-0244-0 http://doi.org/10.1007/s11416-015-0244-0 . .

ARA Grégio , , , AOC Baruque , , , VM Afonso , , , 等 . . Interactive, visual-aided tools to analyze malware behavior . . Proc 12 th Int Conf on Computational Science and Its Applications , , 2012 . . p.302 - - 313 . . DOI: 10.1007/978-3-642-31128-4_22 http://doi.org/10.1007/978-3-642-31128-4_22 . .

A Gupta , , , P Kuppili , , , A Akella , , , 等 . . An empirical study of malware evolution . . Proc 1 st Int Communication Systems and NETworks and Workshops , , 2009 . . p.1 - - 10 . . DOI: 10.1109/COMSNETS.2009.4808876 http://doi.org/10.1109/COMSNETS.2009.4808876 . .

JC Haass , , , GJ Ahn , , , F Grimmelmann . . ACTRA: a case study for threat information sharing . . Proc 2 nd ACM Workshop on Information Sharing and Collaborative Security , , 2015 . . p.23 - - 26 . . DOI: 10.1145/2808128.2808135 http://doi.org/10.1145/2808128.2808135 . .

HD Huang , , , G Acampora , , , V Loia , , , 等 . . Applying FML and fuzzy ontologies to malware behavioural analysis . . Proc IEEE Int Conf on Fuzzy Systems , , 2011 . . p.2018 - - 2025 . . DOI: 10.1109/FUZZY.2011.6007716 http://doi.org/10.1109/FUZZY.2011.6007716 . .

HD Huang , , , CS Lee , , , MH Wang , , , 等 . . IT2FS-based ontology with soft-computing mechanism for malware behavior analysis . . Soft Comput , , 2014 . . 18 ( ( 2 ): ): 267 - - 284 . . DOI: 10.1007/s00500-013-1056-0 http://doi.org/10.1007/s00500-013-1056-0 . .

L Huang , , , AD Joseph , , , B Nelson , , , 等 . . Adversarial machine learning . . Proc 4 th ACM Workshop on Security and Artificial Intelligence , , 2011 . . p.43 - - 58 . . DOI: 10.1145/2046684.2046692 http://doi.org/10.1145/2046684.2046692 . .

D Inoue , , , K Yoshioka , , , M Eto , , , 等 . . Automated malware analysis system and its sandbox for revealing malware's internal and external activities . . IEICE Trans Inform Syst , , 2009 . . E92.D ( ( 5 ): ): 945 - - 954 . . DOI: 10.1587/transinf.E92.D.945 http://doi.org/10.1587/transinf.E92.D.945 . .

G Jacob , , , H Debar , , , E Filiol . . Malware behavioral detection by attribute-automata using abstraction from platform and language . . Proc 12 th Int Symp on Recent Advances in Intrusion Detection , , 2009 . . p.81 - - 100 . . DOI: 10.1007/978-3-642-04342-0_5 http://doi.org/10.1007/978-3-642-04342-0_5 . .

J Jang , , , M Woo , , , D Brumley . . Towards automatic software lineage inference . . Proc 22 nd USENIX Conf on Security , , 2013 . . p.81 - - 96 . . . .

A Kharraz , , , S Arshad , , , C Mulliner , , , 等 . . UNVEIL: a large-scale, automated approach to detecting ransomware . . Proc 25 th USENIX Security Symp , , 2016 . . p.757 - - 772 . . . .

D Kirat , , , G Vigna . . MalGene: automatic extraction of malware analysis evasion signature . . Proc 22 nd ACM SIGSAC Conf on Computer and Communications Security , , 2015 . . p.769 - - 780 . . DOI: 10.1145/2810103.2813642 http://doi.org/10.1145/2810103.2813642 . .

D Kirat , , , G Vigna , , , C Kruegel . . Barecloud: bare-metal analysis-based evasive malware detection . . Proc 23 rd USENIX Conf on Security Symp , , 2014 . . p.287 - - 301 . . . .

E Kirda , , , C Kruegel , , , G Banks , , , 等 . . Behavior-based spyware detection . . Proc 15 th Conf on USENIX Security Symp , , 2006 . . Article 19 . .

I Kirillov , , , D Beck , , , P Chase , , , 等 . . Malware attribute enumeration and characterization (MAEC TM ) . . http://maec.mitre.org/ http://maec.mitre.org/ , , 2011 . . .

T Kokkonen , , , J Hautamaki , , , J Siltanen , , , 等 . . Model for sharing the information of cyber security situation awareness between organizations . . Proc 23 rd Int Conf on Telecommunications , , 2016 . . p.1 - - 5 . . DOI: 10.1109/ICT.2016.7500406 http://doi.org/10.1109/ICT.2016.7500406 . .

C Kruegel . . Full system emulation: achieving successful automated dynamic analysis of evasive malware . . Lastline, Inc., Las Vegas, NV, USA , , 2014 . . .

A Lanzi , , , M Sharif , , , W Lee . . K-Tracer: a system for extracting kernel malware behavior . . Proc Network and Distributed System Security Symp , , 2009 . . p.163 - - 169 . . . .

C Lebiere , , , S Bennati , , , R Thomson , , , 等 . . Functional cognitive models of malware identification . . Proc 13 th Annual Conf on Cognitive Modeling , , 2015 . . p.90 - - 95 . . . .

F Leder , , , B Steinbock , , , P Martini . . Classification and detection of metamorphic malware using value set analysis . . Proc 4 th Int Conf on Malicious and Unwanted Software , , 2009 . . p.39 - - 46 . . DOI: 10.1109/MALWARE.2009.5403019 http://doi.org/10.1109/MALWARE.2009.5403019 . .

T Lee , , , B Choi , , , Y Shin , , , 等 . . Automatic malware mutant detection and group classification based on the n-gram and clustering coefficient . . J Supercomput , , 2015 . . p.1 - - 15 . . DOI: 10.1007/s11227-015-1594-6 http://doi.org/10.1007/s11227-015-1594-6 . .

M Lindorfer , , , C Kolbitsch , , , PM Comparetti . . Detecting environment-sensitive malware . . Proc 14 th Int Symp on Recent Advances in Intrusion Detection , , 2011 . . p.338 - - 357 . . DOI: 10.1007/978-3-642-23644-0_18 http://doi.org/10.1007/978-3-642-23644-0_18 . .

L Liu , , , BS Wang , , , B Yu , , , 等 . . A novel selective ensemble learning based on K-means and negative correlation . . Proc 2 nd Int Conf on Cloud Computing and Security , , 2016 . . p.578 - - 588 . . DOI: 10.1007/978-3-319-48674-1_51 http://doi.org/10.1007/978-3-319-48674-1_51 . .

L Martignoni , , , E Stinson , , , M Fredrikson , , , 等 . . A layered architecture for detecting malicious behaviors . . Proc 11 th Int Symp on Recent Advances in Intrusion Detection , , 2008 . . p.78 - - 97 . . DOI: 10.1007/978-3-540-87403-4_5 http://doi.org/10.1007/978-3-540-87403-4_5 . .

L Martignoni , , , R Paleari , , , D Bruschi . . A framework for behavior-based malware analysis in the cloud . . Proc 5 th Int Conf on Information Systems Security , , 2009 . . p.178 - - 192 . . DOI: 10.1007/978-3-642-10772-6_14 http://doi.org/10.1007/978-3-642-10772-6_14 . .

QG Miao , , , JC Liu , , , Y Cao , , , 等 . . Malware detection using bilayer behavior abstraction and improved one-class support vector machines . . Int J Inform Secur , , 2016 . . 15 ( ( 4 ): ): 361 - - 379 . . DOI: 10.1007/s10207-015-0297-6 http://doi.org/10.1007/s10207-015-0297-6 . .

J Ming , , , Z Xin , , , PW Lan , , , 等 . . Replacement attacks: automatically impeding behavior-based malware specifications . . Proc 13 th Int Conf on Applied Cryptography and Network Security , , 2015 . . p.497 - - 517 . . DOI: 10.1007/978-3-319-28166-7_24 http://doi.org/10.1007/978-3-319-28166-7_24 . .

J Ming , , , Z Xin , , , PW Lan , , , 等 . . Impeding behavior-based malware analysis via replacement attacks to malware specifications . . J Comput Virol Hack Tech , , 2017 . . 13 ( ( 3 ): ): 193 - - 207 . . DOI: 10.1007/s11416-016-0281-3 http://doi.org/10.1007/s11416-016-0281-3 . .

T Mithal , , , K Shah , , , DK Singh . . Case studies on intelligent approaches for static malware analysis. In: Shetty NR, Prasad NH, Nalini N (Eds.), Emerging Research in Computing, Information, Communication and Applications . . Springer, Singapore , , 2016 . . p.555 - - 567 . . DOI: 10.1007/978-981-10-0287-8_52 http://doi.org/10.1007/978-981-10-0287-8_52 . .

A Mohaisen , , , O Alrawi . . AMAL: high-fidelity, behavior-based automated malware analysis and classification . . Proc 15 th Int Workshop on Information Security Applications , , 2015 . . p.107 - - 121 . . DOI: 10.1007/978-3-319-15087-1 http://doi.org/10.1007/978-3-319-15087-1 . .

V Moonsamy , , , RH Tian , , , L Batten . . Feature reduction to speed up malware classification . . Proc 16 th Nordic Conf on Information Security Technology for Applications , , 2012 . . p.176 - - 188 . . DOI: 10.1007/978-3-642-29615-4_13 http://doi.org/10.1007/978-3-642-29615-4_13 . .

A Moser , , , C Kruegel , , , E Kirda . . Exploring multiple execution paths for malware analysis . . Proc IEEE Symp on Security and Privacy , , 2007 . . p.231 - - 245 . . DOI: 10.1109/SP.2007.17 http://doi.org/10.1109/SP.2007.17 . .

S Naval , , , V Laxmi , , , M Rajarajan , , , 等 . . Employing program semantics for malware detection . . IEEE Trans Inform Forens Secur , , 2015 . . 10 ( ( 12 ): ): 2591 - - 2604 . . DOI: 10.1109/TIFS.2015.2469253 http://doi.org/10.1109/TIFS.2015.2469253 . .

M Neugschwandtner , , , C Platzer , , , PM Comparetti , , , 等 . . d Anubis—dynamic device driver analysis based on virtual machine introspection . . Proc 7 th Int Conf on Detection of Intrusions and Malware, and Vulnerability Assessment , , 2010 . . p.41 - - 60 . . DOI: 10.1007/978-3-642-14215-4_3 http://doi.org/10.1007/978-3-642-14215-4_3 . .

E Nunes , , , C Buto , , , P Shakarian , , , 等 . . Malware task identification: a data driven approach . . Proc IEEE/ACM Int Conf on Advances in Social Networks Analysis and Mining , , 2015 . . p.978 - - 985 . . DOI: 10.1145/2808797.2808894 http://doi.org/10.1145/2808797.2808894 . .

P O'Kane , , , S Sezer , , , K McLaughlin , , , 等 . . SVM training phase reduction using dataset feature filtering for malware detection . . IEEE Trans Inform Forens Secur , , 2013 . . 8 ( ( 3 ): ): 500 - - 509 . . DOI: 10.1109/TIFS.2013.2242890 http://doi.org/10.1109/TIFS.2013.2242890 . .

S Palahan , , , D Babić , , , S Chaudhuri , , , 等 . . Extraction of statistically significant malware behaviors . . Proc 29 th Annual Computer Security Applications Conf , , 2013 . . p.69 - - 78 . . DOI: 10.1145/2523649.2523659 http://doi.org/10.1145/2523649.2523659 . .

Y Park , , , DS Reeves , , , M Stamp . . Deriving common malware behavior through graph clustering . . Comput Secur , , 2013 . . 39 419 - - 430 . . DOI: 10.1016/j.cose.2013.09.006 http://doi.org/10.1016/j.cose.2013.09.006 . .

M Pleszkoch , , , R Linger . . Controlling combinatorial complexity in software and malware behavior computation . . Proc 10 th Annual Cyber and Information Security Research Conf , , 2015 . . Article 15 DOI: 10.1145/2746266.2746281 http://doi.org/10.1145/2746266.2746281 . .

S Poeplau , , , Y Fratantonio , , , A Bianchi , , , 等 . . Execute this . . Analyzing unsafe and malicious dynamic code loading in Android applications. Proc Network and Distributed System Security Symp , , 2014 . . p.23 - - 26 . . DOI: 10.14722/ndss.2014.23328 http://doi.org/10.14722/ndss.2014.23328 . .

MFA Razak , , , NB Anuar , , , R Salleh , , , 等 . . The rise of "malware": bibliometric analysis of malware study . . J Netw Comput Appl , , 2016 . . 75 58 - - 76 . . DOI: 10.1016/j.jnca.2016.08.022 http://doi.org/10.1016/j.jnca.2016.08.022 . .

K Rieck , , , T Holz , , , C Willems , , , 等 . . Learning and classification of malware behavior . . Proc 5 th Int Conf on Detection of Intrusions and Malware, and Vulnerability Assessment , , 2008 . . p.108 - - 125 . . DOI: 10.1007/978-3-540-70542-0_6 http://doi.org/10.1007/978-3-540-70542-0_6 . .

K Rieck , , , P Trinius , , , C Willems , , , 等 . . Automatic analysis of malware behavior using machine learning . . J Comput Secur , , 2011 . . 19 ( ( 4 ): ): 639 - - 668 . . DOI: 10.3233/JCS-2010-0410 http://doi.org/10.3233/JCS-2010-0410 . .

R Riley , , , XX Jiang , , , DY Xu . . Multi-aspect profiling of kernel rootkit behavior . . Proc 4 th ACM European Conf on Computer Systems , , 2009 . . p.47 - - 60 . . DOI: 10.1145/1519065.1519072 http://doi.org/10.1145/1519065.1519072 . .

P Royal , , , M Halpin , , , D Dagon , , , 等 . . PolyUnpack: automating the hidden-code extraction of unpack-executing malware . . Proc 22 nd Annual Computer Security Applications Conf , , 2006 . . p.289 - - 300 . . DOI: 10.1109/ACSAC.2006.38 http://doi.org/10.1109/ACSAC.2006.38 . .

J Saxe , , , D Mentis , , , C Greamo . . Visualization of shared system call sequence relationships in large malware corpora . . Proc 9 th Int Symp on Visualization for Cyber Security , , 2012 . . p.33 - - 40 . . DOI: 10.1145/2379690.2379695 http://doi.org/10.1145/2379690.2379695 . .

J Saxe , , , R Turner , , , K Blokhin . . Crowdsource: automated inference of high level malware functionality from low-level symbols using a crowd trained machine learning model . . Proc 9 th Int Conf on Malicious and Unwanted Software: the Americas , , 2014 . . p.68 - - 75 . . DOI: 10.1109/MALWARE.2014.6999417 http://doi.org/10.1109/MALWARE.2014.6999417 . .

ZY Shan , , , X Wang . . Growing grapes in your computer to defend against malware . . IEEE Trans Inform Forens Secur , , 2014 . . 9 ( ( 2 ): ): 196 - - 207 . . DOI: 10.1109/TIFS.2013.2291066 http://doi.org/10.1109/TIFS.2013.2291066 . .

HB Shi , , , T Hamagami , , , K Yoshioka , , , 等 . . Structural classification and similarity measurement of malware . . IEEJ Trans Electr Electron Eng , , 2014 . . 9 ( ( 6 ): ): 621 - - 632 . . DOI: 10.1002/tee.22018 http://doi.org/10.1002/tee.22018 . .

AF Shosha , , , C Liu , , , P Gladyshev , , , 等 . . Evasion-resistant malware signature based on profiling kernel data structure objects . . Proc 7 th Int Conf on Risk and Security of Internet and Systems , , 2012 . . p.1 - - 8 . . DOI: 10.1109/CRISIS.2012.6378949 http://doi.org/10.1109/CRISIS.2012.6378949 . .

P Sirinda . . A framework for mining significant subgraphs and its application in malware analysis . . PhD Thesis, The Pennsylvania State University, Pennsylvania, USA , , 2014 . . .

G Suarez-Tangil , , , M Conti , , , JE Tapiador , , , 等 . . Detecting targeted smartphone malware with behavior-triggering stochastic models . . Proc 19 th European Symp on Research in Computer Security , , 2014 . . p.183 - - 201 . . DOI: 10.1007/978-3-319-11203-9_11 http://doi.org/10.1007/978-3-319-11203-9_11 . .

MK Sun , , , MJ Lin , , , M Chang , , , 等 . . Malware virtualization-resistant behavior detection . . Proc 17 th Int Conf on Parallel and Distributed Systems , , 2011 . . p.912 - - 917 . . DOI: 10.1109/ICPADS.2011.78 http://doi.org/10.1109/ICPADS.2011.78 . .

R Thomson , , , C Lebiere , , , S Bennati , , , 等 . . Malware identification using cognitively-inspired inference . . Proc 24 th Annual Behavior Representation in Modeling and Simulation Conf , , 2015 . . p.1 - - 8 . . . .

P Trinius , , , T Holz , , , J G bel , , , 等 . . Visual analysis of malware behavior using treemaps and thread graphs . . Proc 6 th Int Workshop on Visualization for Cyber Security , , 2009 . . p.33 - - 38 . . DOI: 10.1109/VIZSEC.2009.5375540 http://doi.org/10.1109/VIZSEC.2009.5375540 . .

P Trinius , , , C Willems , , , T Holz , , , 等 . . A malware instruction set for behavior-based analysis . . http://subs.emis.de/LNI/Proceedings/Proceedings170/article5739.html http://subs.emis.de/LNI/Proceedings/Proceedings170/article5739.html , , 2011 . . .

A Walenstein , , , A Lakhotia . . A transformation-based model of malware derivation . . Proc 7 th Int Conf on Malicious and Unwanted Software , , 2012 . . p.17 - - 25 . . DOI: 10.1109/MALWARE.2012.6461003 http://doi.org/10.1109/MALWARE.2012.6461003 . .

SW Wang , , , BS Wang , , , T Yong , , , 等 . . Malware clustering based on SNN density using system calls . . Proc 1 st Int Conf on Cloud Computing and Security , , 2015 . . p.181 - - 191 . . DOI: 10.1007/978-3-319-27051-7_16 http://doi.org/10.1007/978-3-319-27051-7_16 . .

Z Wang , , , XX Jiang , , , WD Cui , , , 等 . . Countering persistent kernel rootkits through systematic hook discovery . . Proc 11 th Int Symp on Recent Advances in Intrusion Detection , , 2008 . . p.21 - - 38 . . DOI: 10.1007/978-3-540-87403-4_2 http://doi.org/10.1007/978-3-540-87403-4_2 . .

MR Watson , , , NUH Shirazi , , , AK Marnerides , , , 等 . . Malware detection in cloud computing infrastructures . . IEEE Trans Depend Sec Comput , , 2016 . . 13 ( ( 2 ): ): 192 - - 205 . . DOI: 10.1109/TDSC.2015.2457918 http://doi.org/10.1109/TDSC.2015.2457918 . .

DJ Wu , , , CH Mao , , , TE Wei , , , 等 . . DroidMat: Android malware detection through manifest and API calls tracing . . Proc 7 th Asia Joint Conf on Information Security , , 2012 . . p.62 - - 69 . . DOI: 10.1109/AsiaJCIS.2012.18 http://doi.org/10.1109/AsiaJCIS.2012.18 . .

T Wüchner , , , M Ochoa , , , A Pretschner . . Robust and effective malware detection through quantitative data flow graph metrics . . Proc 12 th Int Conf on Detection of Intrusions and Malware, and Vulnerability Assessment , , 2015 . . p.98 - - 118 . . DOI: 10.1007/978-3-319-20550-2_6 http://doi.org/10.1007/978-3-319-20550-2_6 . .

C Yang , , , ZY Xu , , , GF Gu , , , 等 . . DroidMiner: automated mining and characterization of fine-grained malicious behaviors in Android applications . . Proc 19 th European Symp on Research in Computer Security , , 2014 . . p.163 - - 182 . . DOI: 10.1007/978-3-319-11203-9_10 http://doi.org/10.1007/978-3-319-11203-9_10 . .

W Yang , , , XS Xiao , , , B Andow , , , 等 . . AppContext: differentiating malicious and benign mobile app behaviors using context . . Proc 37 th IEEE Int Conf on Software Engineering , , 2015 . . p.303 - - 313 . . DOI: 10.1109/ICSE.2015.50 http://doi.org/10.1109/ICSE.2015.50 . .

C Yavvari , , , A Tokhtabayev , , , H Rangwala , , , 等 . . Malware characterization using behavioral components . . Proc 6 th Int Conf on Mathematical Methods, Models, and Architectures for Computer Network Security , , 2012 . . p.226 - - 239 . . DOI: 10.1007/978-3-642-33704-8_20 http://doi.org/10.1007/978-3-642-33704-8_20 . .

SY Yerima , , , S Sezer , , , I Muttik . . High accuracy Android malware detection using ensemble learning . . IET Inform Secur , , 2015 . . 9 ( ( 6 ): ): 313 - - 320 . . DOI: 10.1049/iet-ifs.2014.0099 http://doi.org/10.1049/iet-ifs.2014.0099 . .

H Yin , , , ZK Liang , , , D Song . . HookFinder: identifying and understanding malware hooking behaviors . . Proc Network and Distributed System Security Symp , , 2008 . . p.1 - - 16 . . . .

JF Yuan , , , WZ Qiang , , , H Jin , , , 等 . . Cloudtaint: an elastic taint tracking framework for malware detection in the cloud . . J Supercomput , , 2014 . . 70 ( ( 3 ): ): 1433 - - 1450 . . DOI: 10.1007/s11227-014-1235-5 http://doi.org/10.1007/s11227-014-1235-5 . .

FW Zhang , , , K Leach , , , A Stavrou , , , 等 . . Using hardware features for increased debugging transparency . . Proc IEEE Symp on Security and Privacy , , 2015 . . p.55 - - 69 . . DOI: 10.1109/SP.2015.11 http://doi.org/10.1109/SP.2015.11 . .

H Zhang , , , DF Yao , , , N Ramakrishnan , , , 等 . . Causality reasoning about network events for detecting stealthy malware activities . . Comput Secur , , 2016 . . 58 180 - - 198 . . DOI: 10.1016/j.cose.2016.01.002 http://doi.org/10.1016/j.cose.2016.01.002 . .

M Zhang , , , Y Duan , , , H Yin , , , 等 . . Semantics-aware Android malware classification using weighted contextual API dependency graphs . . Proc ACM SIGSAC Conf on Computer and Communications Security , , 2014 . . p.1105 - - 1116 . . DOI: 10.1145/2660267.2660359 http://doi.org/10.1145/2660267.2660359 . .

ZQ Zhao , , , JF Wang , , , JR Bai . . Malware detection method based on the control-flow construct feature of software . . IET Inform Secur , , 2014 . . 8 ( ( 1 ): ): 18 - - 24 . . DOI: 10.1049/iet-ifs.2012.0289 http://doi.org/10.1049/iet-ifs.2012.0289 . .

YJ Zhou , , , XX Jiang . . Dissecting Android malware: characterization and evolution . . Proc IEEE Symp on Security and Privacy , , 2012 . . p.95 - - 109 . . DOI: 10.1109/SP.2012.16 http://doi.org/10.1109/SP.2012.16 . .

浏览量

Downloads

CSCD

文章被引用时，请邮件提醒。

Submit

工具集

关联资源

Discovering optimal features using static analysis and a genetic search based method for Android malware detection

Large language model-enhanced probabilistic modeling for effective static analysis alarms

Domain adaptation in reinforcement learning: a comprehensive and systematic study

Towards sustainable adversarial training with successive perturbation generation

Advances and challenges in artificial intelligence text generation