Evaluating model checking for cyber threats code obfuscation identification

Fabio Martinelli

doi:10.1016/j.jpdc.2018.04.008

Evaluating model checking for cyber threats code obfuscation identification

2018-09-01

23

PRE

AI

Arun Kumar Sangaiah *

A

A. Cimitile

DOI：10.1016/j.jpdc.2018.04.008

Original

Original request for help

Save

Abstract

En 中文

Code obfuscation is a set of transformations that make code programs harder to understand. The goal of code obfuscation is to make reverse engineering of programs infeasible, while maintaining the logic on the program. Originally, it has been used to protect intellectual property. However, recently code obfuscation has been also used by malware writers in order to make cyber threats easily able to evade antimalware scanners. As a matter of fact, metamorphic and polymorphic viruses exhibit the ability to obfuscate their code as they propagate. In this paper we propose a model checking-based approach which is able to identify the most widespread obfuscating techniques, without making any assumptions about the nature of the obfuscations used. We evaluate the proposed method on a real-world data set obtaining an accuracy equal to 0.9 in the identification of obfuscation techniques. (C) 2018 Elsevier Inc. All rights reserved.

Keywords:

Obfuscation

Android

Model checking

Formal methods

Malware

Evaluating model checking for cyber threats code obfuscation identification

Abstract

AI Summary

Journal

Organization