Exploiting an antivirus interface

Kevin W. Hamlen

doi:10.1016/j.csi.2009.04.004

2009-11-01

Kevin W. Hamlen *

Vishwath Mohan

Mohammad Mehedy Masud

Latifur Khan

Bhavani Thuraisingham

DOI：10.1016/j.csi.2009.04.004

原文链接

查看原文

摘要

En 中文

We propose a technique for defeating signature-based malware detectors by exploiting information disclosed by antivirus interfaces. This information is leveraged to reverse engineer relevant details of the detector's underlying signature database, revealing binary obfuscations that suffice to conceal malware from the detector. Experiments with real malware and antivirus interfaces on Windows operating systems justify the effectiveness of our approach. (C) 2009 Elsevier B.V. All rights reserved.

Keyword:

Security

Signature-based malware detection

Data mining

Binary obfuscation