Improved call graph comparison using simulated annealing

O Kostakis, J Kinable, H Mahmoudi… - Proceedings of the 2011 …, 2011 - dl.acm.org
O Kostakis, J Kinable, H Mahmoudi, K Mustonen
Proceedings of the 2011 ACM Symposium on Applied Computing, 2011dl.acm.org
The amount of suspicious binary executables submitted to Anti-Virus (AV) companies are in
the order of tens of thousands per day. Current hash-based signature methods are easy to
deceive and are inefficient for identifying known malware that have undergone minor
changes. Examining malware executables using their call graphs view is a suitable
approach for overcoming the weaknesses of hash-based signatures. Unfortunately, many
operations on graphs are of high computational complexity. One of these is the Graph Edit …
The amount of suspicious binary executables submitted to Anti-Virus (AV) companies are in the order of tens of thousands per day. Current hash-based signature methods are easy to deceive and are inefficient for identifying known malware that have undergone minor changes. Examining malware executables using their call graphs view is a suitable approach for overcoming the weaknesses of hash-based signatures. Unfortunately, many operations on graphs are of high computational complexity. One of these is the Graph Edit Distance (GED) between pairs of graphs, which seems a natural choice for static comparison of malware. We demonstrate how Simulated Annealing can be used to approximate the graph edit distance of call graphs, while outperforming previous approaches both in execution time and solution quality. Additionally, we experiment with opcode mnemonic vectors to reduce the problem size and examine how Simulated Annealing is affected.
ACM Digital Library
以上显示的是最相近的搜索结果。 查看全部搜索结果

Google学术搜索按钮

example.edu/paper.pdf
搜索
获取 PDF 文件
引用
References