Automated Analyses of Malicious Code
Year: 2009
Type: article
Abstract: Malware (malicious software) is a general term for any malicious program such as a virus, worm, trojan, bot or rootkit. The prevalence of malware is rapidly growing on the Internet and poses an increasing threat to computer systems. Effective incident handling can be achieved by analysing malware in order to understand its functionality and capacity. This may involve analysing already compromised systems or assessing the level of risk for systems being exposed to such a threat. However, malware analysis is labour intensive and time consuming, and does not scale well with the ever increasing prevalence of malware. Automating parts of the analysis process can reduce the required amount of human intervention, and save precious time during the analysis. Techniques involving running malware in a controlled and secure environment whilst monitoring its behaviour is often referred to as dynamic analysis. This project should focus on studying dynamic malware analyses, and automate such a process. The student is free to automate any analysis process that is regarded dynamic, but it would be preferable if the information gained from the automated analysis is actionable. That is, the information gained is directly useful for handling the particular incident(s) where the malware is involved. The project may optionally look into integrating the final system with NorCERT's internal system for handling malware samples.
Author: Kris Mikael Krister
Language: English
Subfield: Software
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W1602547571