- Title
- Detecting derivative malware samples using deobfuscation-assisted similarity analysis
- Creator
- Wrench, Peter
- Creator
- Irwin, Barry V W
- Date Issued
- 2016
- Date
- 2016
- Type
- text
- Type
- article
- Identifier
- http://hdl.handle.net/10962/429494
- Identifier
- vital:72617
- Identifier
- 10.23919/SAIEE.2016.8531543
- Description
- The abundance of PHP-based Remote Access Trojans (or web shells) found in the wild has led malware researchers to develop systems capable of tracking and analysing these shells. In the past, such shells were ably classified using signature matching, a process that is currently unable to cope with the sheer volume and variety of web-based malware in circulation. Although a large percentage of newly-created webshell software incorporates portions of code derived from seminal shells such as c99 and r57, they are able to disguise this by making extensive use of obfuscation techniques intended to frustrate any attempts to dissect or reverse engineer the code. This paper presents an approach to shell classification and analysis (based on similarity to a body of known malware) in an attempt to create a comprehensive taxonomy of PHP-based web shells. Several different measures of similarity were used in conjunction with clustering algorithms and visualisation techniques in order to achieve this. Furthermore, an auxiliary component capable of syntactically deobfuscating PHP code is described. This was employed to reverse idiomatic obfuscation constructs used by software authors. It was found that this deobfuscation dramatically increased the observed levels of similarity by exposing additional code for analysis.
- Format
- 11 pages
- Format
- Language
- English
- Relation
- SAIEE Africa Research Journal
- Relation
- Wrench, P. and Irwin, B., 2016. Detecting derivative malware samples using deobfuscation-assisted similarity analysis. SAIEE Africa Research Journal, 107(2), pp.65-77
- Relation
- SAIEE Africa Research Journal volume 107 number 2 65 77 2016 1991-1696
- Rights
- Publisher
- Rights
- Use of this resource is governed by the terms and conditions of the IEEE Xplore Terms of Use Statement (https://ieeexplore.ieee.org/Xplorehelp/overview-of-ieee-xplore/terms-of-use)
- Hits: 85
- Visitors: 85
- Downloads: 4
Collections
Irwin, Barry V W (Prof)
RU Department of Computer Science
SDG 09. Industry, Innovation and Infrastructure
| Thumbnail | File | Description | Size | Format | |||
|---|---|---|---|---|---|---|---|
| View Details Download | SOURCE1 | Detecting derivative malware samples using deobfuscation-assisted similarity analysis.pdf | 644 KB | Adobe Acrobat PDF | View Details Download |