Hauptseminar: Security - Zwischen formalen Methoden und Praxis Malicious code detection

In any defense mechanism, malicious code detection is a crucial component. To subvert malicious code detectors, e.g anti-virus software, malicious code writers try to subvert these detectors by obfuscating the malicious code. As testing results surprisingly showed, commercial virus scanners were not able to detect infected binaries which were transformed by applying simple obfuscation techniques. This paper presents an architecture called SAFE (a static analyzer for executables) developed at University of Wisconsin which is resilient to common obfuscation transformations by not relying upon signature matching but model-checking techniques.