Year: 2014
Type: article
Abstract: Malware writers have employed various obfuscation and polymorphism techniques to thwart static analysis approaches and bypassing antivirus tools.Dynamic analysis techniques, however, have essentially overcome these deceits by observing the actual behaviour of the code execution.In this regard, various methods, techniques and tools have been proposed.However, because of the diverse concepts and strategies used in the implementation of these methods and tools, security researchers and malware analysts find it difficult to select the required optimum tool to investigate the behaviour of a malware and to contain the associated risk for their study.Focusing on two dynamic analysis techniques: Function Call monitoring and Information Flow Tracking, this paper presents a comparison framework for dynamic malware analysis tools.The framework will assist the researchers and analysts to recognize the tool's implementation strategy, analysis approach, system-wide analysis support and its overall handling of binaries, helping them to select a suitable and effective one for their study and analysis.
Author: Waqas Aman
Institution: Gjøvik University College
Language: English
Subfield: Signal Processing
Field: Computer Science
Domain: Physical Sciences
Open Access status: bronze
OpenAlex ID: W2056625284