Exploring Multiple Execution Paths for Malware Analysis

By Andreas Moser and Christopher Kruegel and Engin Kirda

Proceedings of the 2007 IEEE Symposium on Security and Privacy

Authors of the paper address the problem of malware which doesn’t display malicious behaviour unless certain trigger conditions are present. Dynamic taint-tracking is used to discover conditionals in the program that are dependent on tainted inputs. When one of the two branches of such a conditional is about to be taken, they create a checkpoint and a snapshot of the analyzed process, and keeps exploring one of the branch. Subsequently, when the exploration of the taken branch ends or after a timeout threshold is reached, they force the execution of the unexplored branch.

The paper can be found here.

Advertisement