Modelling Metamorphism by Abstract Interpretation
Roberto
Giacobazzi
Dip. di Informatica
Univsit\agrave di Verona
Strada Le Grazie a Ca' Vignal 2, 37134 Verona (Italy)
roberto.giacobazzi@univr.it
joint with:
Mila Dalla Preda,
Saumya K. Debray,
Kevin Coogan, and
Gregg M. Townsend.
Abstract:
Metamorphic malware apply semantics-preserving transformations to their
own code in order to foil detection systems based on signature matching. In this paper
we consider the problem of modelling metamorphic malware in order to extract a
metamorphic signatures. We introduce a semantics for self-modifying code, later called
phase semantics, and prove its correctness by showing that it is an abstract interpretation
of the standard trace semantics. Phase semantics precisely models the metamorphic
code behavior by providing a set of traces of programs which correspond to the possible
evolutions of the metamorphic code during execution. We show that metamorphic signatures
can be automatically extracted by abstract interpretation of the phase semantics,
and that regular metamorphism can be modelled as finite state automata abstraction of
the phase semantics.
Related papers:
roberto.giacobazzi@univr.it