DETECTION OF GLOBAL METAMORPHIC MALWARE VARIANTS USING CONTROL AND DATA FLOW ANALYSIS
Malware feature extraction derives semantic summaries of executable malware using global, inter-procedural program analysis techniques. A combination of global, inter-procedural program analysis techniques constructs semantic summaries of malware which automatically detect and discard any noise introduced by transformations and capture the essence of the underlying computations in a succinct form. This is achieved in two ways. First, global control flow analysis techniques are used to derive a high level representation of malware code that, for instance, removes the effects of subroutine calls. Second, global data flow analysis techniques are employed to detect and remove all spurious elements of malware that do not contribute towards its underlying computation, thereby preventing the resulting summaries from being “corrupted” with unnecessary, extraneous elements.
1 . A method of deriving malware signatures comprising:
applying global control flow analysis to code containing malware to provide a high level representation of malware code;
applying global data flow analysis to code containing malware to detect and remove spurious elements of malware to provide malware-free code; and
combining the high level representation and malware-free code outputs.
2 . The method as set forth in claim 1 , wherein said combining comprises projecting the representation over the malware-free code thereby creating a high level semantic summary.
3 . The method as set forth claim 1 , wherein said control flow analysis partitions statements in malware code into super blocks.
4 . The method as set forth in claim 1 , further comprising arranging said partitions into a super block dominator tree
5 . The method as set forth in claim 1 , wherein said data flow analysis creates a program slice from a program dependence graph.