SCMA: Scalable and Collaborative Malware Analysis using System Call Sequences

Malware is huge and growing at an exponential pace. Symantec observes 403 million new malware samples in 2011. Therefore, that efficiently and effectively analysis so many malware samples becomes a great challenge. Centralized systems cause problems of single point of failure as well as processing bottlenecks. Previous distributed systems are mainly applied for specific or simple malware. This paper presents SCMA, a new distributed malware analysis system which can analyze various malware, shares behavior fragments among its monitors efficiently, analyzes malware based on global behavior of malware and aggregates those analyses among monitors in a load-balance way. We implemented a proof-of-concept version of SCMA and performed experiments with 917 real-world malware samples; preliminary results from our evaluation confirm that SCMA has comparable performance with centralized system, but much better scalability, and is approximately consistent with the analysis of AV scanners.