Optimized analysis with binary procedure to detect malware behaviors

Author: 
Mamatha B and Mounika B

Binary analysis finds loop holes/vulnerabilities and defects in binary code such executables or deployed applications, so that one can analyze third party applications or libraries without the need to their application's source code. But these analytics fail increase of binary file obfuscations which happens to be the current trend of new generation malwares and prior implementations all fail in handling them. Although a new approach using Cipher X Ray prototype has satisfactory workarounds to handle such malware binary obfuscations it's ability is contained to block cipher operations only. So, we propose to Extend its capability to support stream ciphers using a key scheduling algorithm and assess and acquires internal state information of obfuscated binary file to reveal stream ciphers that can be useful for binary analytics. Combined with Key scheduling for stream ciphers, Cipher Ray attains the ability to scan through a binary file that is obfuscated using either a stream or blocked cipher. And this sort of early detections prevents the propagation of malware and a demonstrational prototype validates our claim.

Download PDF: 
DOI: 
http://dx.doi.org/10.24327/ijcar.2018.9798.1633
Select Volume: 
Volume7