Computer Engineering Commons^™

Instructions-Based Detection Of Sophisticated Obfuscation And Packing, Moustafa Saleh, Edward Paul Ratazzi, Shouhuai Xu

Electrical Engineering and Computer Science - All Scholarship

Every day thousands of malware are released online. The vast majority of these malware employ some kind of obfuscation ranging from simple XOR encryption, to more sophisticated anti-analysis, packing and encryption techniques. Dynamic analysis methods can unpack the file and reveal its hidden code. However, these methods are very time consuming when compared to static analysis. Moreover, considering the large amount of new malware being produced daily, it is not practical to solely depend on dynamic analysis methods. Therefore, finding an effective way to filter the samples and delegate only obfuscated and suspicious ones to more rigorous tests would significantly …