Function classification for the retro-engineering of malwares

Guillaume Bonfante (1) , Julien Oury--Nogues (1)

1 CARBONE - Carbone

In the past ten years, our team has developed a method called morphological analysis that deals with malware detection. Morphological analysis focuses on algorithms. Here, we want to identify programs through their functions, and more precisely with the intention of those functions. The intention is described as a vector in a high dimensional vector space in the spirit of compositional semantics. We show how to use the intention of functions for their clustering. In a last step, we describe some experiments showing the relevance of the clustering and some of some possible applications for malware identification.

Domaines: Informatique [cs]; Cryptographie et sécurité [cs.CR]

Guillaume Bonfante, Julien Oury--Nogues. Function classification for the retro-engineering of malwares. 9th International Symposium Foundations and Practice of Security, Oct 2016, Quebec, Canada. ⟨hal-03178819⟩