Tutorial: an Overview of Malware Detection and Evasion Techniques

Fabrizio Biondi (1) , Thomas Given-Wilson (1) , Axel Legay (1) , Cassius Puodzius (1) , Jean Quilbeuf (2)

1 TAMIS - Threat Analysis and Mitigation for Information Security
2 VERIMAG - IMAG - VERIMAG

This tutorial presents and motivates various malware detection tools and illustrates their usage on a clear example. We demonstrate how statically-extracted syntactic signatures can be used for quickly detecting simple variants of malware. Since such signatures can easily be obfuscated, we also present dynamically-extracted behavioral signatures which are obtained by running the malware in an isolated environment known as a sandbox. However, some malware can use sandbox detection to detect that they run in such an environment and so avoid exhibiting their malicious behavior. To counteract sandbox detection, we present concolic execution that can explore several paths of a binary. We conclude by showing how opaque predicates and JIT can be used to hinder concolic execution.

Domaines: Cryptographie et sécurité [cs.CR]

Fabrizio Biondi, Thomas Given-Wilson, Axel Legay, Cassius Puodzius, Jean Quilbeuf. Tutorial: an Overview of Malware Detection and Evasion Techniques. ISoLA 2018 - 8th International Symposium On Leveraging Applications of Formal Methods, Verification and Validation, Oct 2018, Limassol, Cyprus. pp.1-23. ⟨hal-01964222⟩