Security Management White Papers

Abstract Stack Graph to Detect Obfuscated Calls in Binaries

• Tags:
• security management,
• element,
• code,
• detect

Overview Programmers obfuscate their code with the intent of making it difficult to discern information from the code. Programs may be obfuscated to protect intellectual property and to increase security of code. Programs may also be obfuscated to hide malicious behavior and to evade detection by anti-virus scanners. This paper presents a method to statically detect obfuscated calls in binary code. The notion of abstract stack is introduced to associate each element in the stack to the instruction that pushes the element. An abstract stack graph is a concise representation of all abstract stacks at every point in the program. An abstract stack graph, created by abstract interpretation of the binary executables, may be used to detect obfuscated calls and other stack related obfuscations.

• 
• Did you find this white paper useful? 1 out of 1 users found this white paper useful

• Subscribe to the IT White Papers Newsletter
• White Paper RSS