Digging for datastructures (to identify malware)

Anthony Cozzie has built a system for detecting datastructures in applications’ heap memory. In this paper he presents the method and applies it to malware detection. His premise is that data layout is much harder to vary automatically than instructions (polymorphism). Therefore, data offers a better signature than instructions. He verifies this intuition by comparing multiple versions of Kraken and Storm (among others). A great example of generic system’s work applied to security. The full paper at OSDI 2008 can be found here.

Advertisement