AGIS: Towards automatic generation of infection signatures

An important yet largely uncharted problem in malware defense is how to automate generation of infection signatures for detecting compromised systems, i.e., signatures that characterize the behavior of malware residing on a system. To this end, we develop AGIS, the first host-based technique that detects infections by novel malware and automatically generates an infection signature of the malware. AGIS monitors the runtime behavior of suspicious code according to a set of security policies to detect a previously undetected infection, and then identifies its characteristic behavior in terms of system or API calls. AGIS then statically analyzes the corresponding executables to extract the instructions important to the infection’s mission. These instructions can be used to build a template for a static-analysis-based scanner, or a regular-expression signature for legacy scanners. AGIS also detects encrypted malware and generates a signature from its plaintext decryption loop. We impl...

• Type: Conference
• Year: 2008
• Where: DSN
• Authors: Zhuowei Li, XiaoFeng Wang, Zhenkai Liang, Michael K. Reiter
• Keywords: Computer Networks, DSN 2008, Infection Signature, Malware, Malware Defense