6th European Conference - Academic Conferences

Jaime Acosta
Figure 3: Average percentage of the large set that is accounted for by common substrings of the
small set
7. Conclusions and future work
This paper has provided a technique that can be used for similarity analysis on malware, based on
dynamic behavior that was captured using CWSandbox. The results show that the similarities are not
restricted to small sequences; many large sequences are shared among the malware instances,
which mean that there are in fact many shared behaviors present that could be identified and possibly
labeled using natural language to reduce an analyst’s workload, matching the intentions of Kirillov et
al. (2010).
Future work will test the methods described in this paper with a larger dataset. In addition, instead of
limiting the process to sequential instructions, it may be useful to instead identify templates of
behavior, as Christodorescu et al. (2005) did for static malware analysis. For example, there may be a
trace that contains a sequence of five wait events and another with ten. Semantically, these are
almost equivalent, but the common substring algorithm presented here does not capture this; a
template method could. Tailoring to malware some techniques used in identifying code clones, such
as in (Roy and Cody, 2007) may also prove useful.
The work described here is an initial step for a tool that can be used to semantically label portions of
files to allow for more efficient identification of both redundancy (use of legitimate 3 rd party libraries)
and overlap (reuse of malware code) in malware instances.
Acknowledgments
I would like to thank Victor Mena, Ken Fabela, and Michael Shaughnessy for their valuable comments
and suggestions that led to the maturation of this work. Also, I would like to thank Konrad Rieck and
colleagues for the dataset and feedback.
References
Baecher, P., Koetter, M., Holz, T., Dornseif, M. and Freiling, F. (2006) “The Nepenthes platform: An efficient
approach to collect malware”, Recent Advances in Intrusion Detection, No. 4219, pp 165–184.
Bayer, U., Comparetti, P.M., Hlauschek, C., Kruegel, C. and Kirda, E. (2009) “Scalable, behavior-based malware
clustering”, Network and Distributed System Security Symposium (NDSS).
Bayer, U., Moser, A., Krügel, C. and Kirda, E. (2006) “Dynamic analysis of malicious code”, Journal in Computer
Virology, Vol. 2, No. 1, pp 67–77.
Christodorescu, M., Jha, S., Seshia, S. A., Song, D. and Bryant, R.E. (2005) “Semantics-Aware Malware
Detection”, IEEE Symposium on Security and Privacy, pp 32–46.
6