On behavioral detection

Philippe Beaucamps (1) , Jean-Yves Marion (1)

1 CARTE - Theoretical adverse computations, and safety

This study is about behavioral detection based on automata over infinite words. Malware are considered as concurrent systems, which interact with an environment. So malware traces are now infinite words. We propose a NLOGSPACE behavioral detection method based on B¨uchi automata. The goal of this paper is to present in a nutshell some theoretical aspects behind behavioral analysis. We don't take up questions related to implementations, which will be studied in forthcoming papers.

Domaines: Automatique

Philippe Beaucamps, Jean-Yves Marion. On behavioral detection. 18th EICAR Annual Conference 2009, May 2009, Berlin, Germany. ⟨hal-00758423⟩