.png){kind=icon}
Return
Covert Computation Hiding code in code through compile-time obfuscation
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2013.12.006.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Recently, the concept of semantic-aware malware detection has been proposed in the literature. Instead of relying on a syntactic analysis (i.e., comparison of a program to pregenerated signatures of malware samples), semantic-aware malware detection tries to model the effects a malware sample has on the machine. Thus, it does not depend on a specific syntactic implementation. For this purpose a model of the underlying machine is used. While it is possible to construct more and more precise models of hardware architectures, we show that there are ways to implement hidden functionality based on side effects in the microprocessor that are difficult to cover With a model. In this paper we give a comprehensive analysis of side effects in the x86 architecture and describe an implementation concept based on the idea of compile-time obfuscation, where obfuscating transformations are applied to the code at compile time. Finally, we provide an evaluation based on a prototype implementation to show the practicability of our approach and estimate complexity and space overhead using actual malware samples. (C) 2014 Elsevier Ltd. All rights reserved.
Keywords:
Code obfuscation
Side effect
Code steganography
Semantic-aware malware detection
Compile-time obfuscation
AI Summary
Key information extracted from the uploaded paper, including a brief overview, abstract, background, key highlights, visual analysis, and future outlook.
Journal
C
IF:
5.4
Papers:
4.6K
Citations:
1.4W
Organization
Cited Papers
Stimulation of craniofacial muscle afferents induces prolonged facilitatory effects in trigeminal nociceptive brain-stem neurones.png)
Pain
PainIF0
PREAI
ShareSaveA set of robust fluorescent peptide probes for quantification of Cu(ii) binding affinities in the micromolar to femtomolar rangeMetallomics
OAAI
MetallomicsIF0
OAAIShareSaveAllosteric Regulation in Phosphofructokinase from the Extreme Thermophile Thermus thermophilusBiochemistryOAAI
BiochemistryIF0
OAAIShareSaveShareSaveShareSave no more
no more