Network Security White Papers

Malware Normalization

• Tags:
• network security,
• host,
• commercial,
• detection

Overview Malware is code designed for a malicious purpose, such as obtaining root privilege on a host. A malware detector identifies malware and thus prevents it from adversely affecting a host. In order to evade detection by malware detectors, malware writers use various obfuscation techniques to transform their malware. There is strong evidence that commercial malware detectors are susceptible to these evasion tactics. This paper describes the design and implementation of a malware normalizer that undoes the obfuscations performed by a malware writer. The experimental evaluation demonstrates that a malware normalizer can drastically improve detection rates of commercial malware detectors. Moreover, a malware normalizer can also ease the task of forensic analysis of malware.

• 
• Did you find this white paper useful? 4 out of 5 users found this white paper useful

• Subscribe to the IT White Papers Newsletter
• White Paper RSS