See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/308793546 Automatic code features extraction using bio-inspired algorithms - presentation Data · October 2016 CITATIONS READS 0 35 3 authors , including: Ciprian Oprisa Adrian Cole ș a Universitatea Tehnica Cluj-Napoca Universitatea Tehnica Cluj-Napoca 32 PUBLICATIONS 70 CITATIONS 32 PUBLICATIONS 67 CITATIONS SEE PROFILE SEE PROFILE Some of the authors of this publication are also working on these related projects: Virtualization-Based Security of User Security-Sensitive Applications View project All content following this page was uploaded by Ciprian Oprisa on 03 October 2016. The user has requested enhancement of the downloaded file.
Automatic Code Features Extraction Using Bio-inspired Algorithms EICAR 2013 Ciprian Opris , a , George Cab˘ au and Adrian Coles , a Bitdefender, Technical University of Cluj-Napoca November 18, 2013
Agenda Introduction 1 Objectives 2 OpCodes Extraction and Normalization 3 Automatic Filters Selection 4 Experimental results 5 Conclusions and future work 6 C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 2 / 25
1. Introduction Agenda Introduction 1 Objectives 2 OpCodes Extraction and Normalization 3 Automatic Filters Selection 4 Experimental results 5 Conclusions and future work 6 C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 3 / 25
1. Introduction Where are we? (1) We need to detect malware. � �� � ↓ Hash(es) ↓ ? Malware database ւ ց C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 4 / 25
1. Introduction Where are we? (2) � �� � ↓ C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 5 / 25
1. Introduction Where are we? (2) � �� � ↓ → push , mov , sub , mov , push , lea , push , call , mov , . . . → pmsmplpcmlpctjczczczmJ C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 5 / 25
1. Introduction Where are we? (2) � �� � ↓ → push , mov , sub , mov , push , lea , push , call , mov , . . . → pmsmplpc mlpctjczczczmJ <pmsmplpc> C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 5 / 25
1. Introduction Where are we? (2) � �� � ↓ → push , mov , sub , mov , push , lea , push , call , mov , . . . → p msmplpcm lpctjczczczmJ <pmsmplpc> , <msmplpcm> C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 5 / 25
1. Introduction Where are we? (2) � �� � ↓ → push , mov , sub , mov , push , lea , push , call , mov , . . . → pm smplpcml pctjczczczmJ <pmsmplpc> , <msmplpcm> , <smplpcml> C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 5 / 25
1. Introduction Where are we? (2) � �� � ↓ → push , mov , sub , mov , push , lea , push , call , mov , . . . → pms mplpcmlp ctjczczczmJ <pmsmplpc> , <msmplpcm> , <smplpcml> , <mplpcmlp> C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 5 / 25
1. Introduction Where are we? (2) � �� � ↓ → push , mov , sub , mov , push , lea , push , call , mov , . . . → pmsm plpcmlpc tjczczczmJ <pmsmplpc> , <msmplpcm> , <smplpcml> , <mplpcmlp> , <plpcmlpc> C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 5 / 25
1. Introduction Where are we? (2) � �� � ↓ → push , mov , sub , mov , push , lea , push , call , mov , . . . → pmsmplpcmlpctjczczczmJ <pmsmplpc> , <msmplpcm> , <smplpcml> , <mplpcmlp> , <plpcmlpc> , . . . C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 5 / 25
1. Introduction Where are we? (2) � �� � ↓ → push , mov , sub , mov , push , lea , push , call , mov , . . . → pmsmplpcmlpctjczczczmJ <pmsmplpc> , <msmplpcm> , <smplpcml> , <mplpcmlp> , <plpcmlpc> , . . . ↓ ? Malware database ւ ց C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 5 / 25
2. Objectives Agenda Introduction 1 Objectives 2 OpCodes Extraction and Normalization 3 Automatic Filters Selection 4 Experimental results 5 Conclusions and future work 6 C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 6 / 25
2. Objectives Objectives Goal Improve detection on .NET malware by filtering the OpCodes to extract more meaningful n-grams. Extract OpCode sequences from .NET applications. Eliminate unreachable code. Design a fitness function to evaluate the quality of an OpCode filter. Use bio-inspired algorithms to find the best filter. C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 7 / 25
3. OpCodes Extraction and Normalization Agenda Introduction 1 Objectives 2 OpCodes Extraction and Normalization 3 Automatic Filters Selection 4 Experimental results 5 Conclusions and future work 6 C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 8 / 25
3. OpCodes Extraction and Normalization Parsing and disassembling .NET === Method 4: name=’mpress._::Main’; RVA=0x0000254C; FA=0x0000074C; size=0x9A === = Exception handlers: 000025D6; = An extension of the 0000254C: [00] nop 0000254D: [28 0E 00 00 0A] call 0x0A00000E Microsoft Portable 00002552: [12 00] ldloca.s 0x00 00002554: [28 03 00 00 06] call 0x06000003 Executable format 00002559: [13 06] stloc.s 0x06 0000255B: [11 06] ldloc.s 0x06 0000255D: [2D 10] brtrue.s 0x10 Many, many tables 0000255F: [00] nop 00002560: [72 01 00 00 70] ldstr 0x70000001 00002565: [72 23 00 00 70] ldstr 0x70000023 0000256A: [28 0F 00 00 0A] call 0x0A00000F 0000256F: [26] pop 00002570: [15] ldc.i4.m1 00002571: [13 05] stloc.s 0x05 00002573: [2B 02] br.s 0x02 00002575: [26] pop 00002576: [06] ldloc.0 00002577: [28 10 00 00 0A] call 0x0A000010 0000257C: [80 01 00 00 04] stsfld 0x04000001 00002581: [7E 01 00 00 04] ldsfld 0x04000001 00002586: [6F 11 00 00 0A] callvirt 0x0A000011 0000258B: [0B] stloc.1 ... C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 9 / 25
3. OpCodes Extraction and Normalization Parsing and disassembling .NET === Method 4: name=’mpress._::Main’; RVA=0x0000254C; FA=0x0000074C; size=0x9A === = Exception handlers: 000025D6; = An extension of the 0000254C: [00] nop 0000254D: [28 0E 00 00 0A] call 0x0A00000E Microsoft Portable 00002552: [12 00] ldloca.s 0x00 00002554: [28 03 00 00 06] call 0x06000003 Executable format 00002559: [13 06] stloc.s 0x06 0000255B: [11 06] ldloc.s 0x06 0000255D: [2D 10] brtrue.s 0x10 Many, many tables 0000255F: [00] nop 00002560: [72 01 00 00 70] ldstr 0x70000001 00002565: [72 23 00 00 70] ldstr 0x70000023 0000256A: [28 0F 00 00 0A] call 0x0A00000F 0000256F: [26] pop 00002570: [15] ldc.i4.m1 00002571: [13 05] stloc.s 0x05 00002573: [2B 02] br.s 0x02 00002575: [26] pop 00002576: [06] ldloc.0 00002577: [28 10 00 00 0A] call 0x0A000010 0000257C: [80 01 00 00 04] stsfld 0x04000001 00002581: [7E 01 00 00 04] ldsfld 0x04000001 00002586: [6F 11 00 00 0A] callvirt 0x0A000011 0000258B: [0B] stloc.1 ... C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 9 / 25
3. OpCodes Extraction and Normalization Parsing and disassembling .NET === Method 4: name=’mpress._::Main’; RVA=0x0000254C; FA=0x0000074C; size=0x9A === = Exception handlers: 000025D6; = An extension of the 0000254C: [00] nop 0000254D: [28 0E 00 00 0A] call 0x0A00000E Microsoft Portable 00002552: [12 00] ldloca.s 0x00 00002554: [28 03 00 00 06] call 0x06000003 Executable format 00002559: [13 06] stloc.s 0x06 0000255B: [11 06] ldloc.s 0x06 0000255D: [2D 10] brtrue.s 0x10 Many, many tables 0000255F: [00] nop 00002560: [72 01 00 00 70] ldstr 0x70000001 00002565: [72 23 00 00 70] ldstr 0x70000023 0000256A: [28 0F 00 00 0A] call 0x0A00000F 0000256F: [26] pop 00002570: [15] ldc.i4.m1 00002571: [13 05] stloc.s 0x05 00002573: [2B 02] br.s 0x02 00002575: [26] pop 00002576: [06] ldloc.0 00002577: [28 10 00 00 0A] call 0x0A000010 0000257C: [80 01 00 00 04] stsfld 0x04000001 00002581: [7E 01 00 00 04] ldsfld 0x04000001 00002586: [6F 11 00 00 0A] callvirt 0x0A000011 0000258B: [0B] stloc.1 ... C. Opris , a (Bitdefender) Automatic Code Features Extraction Using Bio-inspired Algorithms November 18, 2013 9 / 25
Recommend
More recommend
