Sciweavers

Share
DSN
2008
IEEE

AGIS: Towards automatic generation of infection signatures

9 years 4 months ago
AGIS: Towards automatic generation of infection signatures
An important yet largely uncharted problem in malware defense is how to automate generation of infection signatures for detecting compromised systems, i.e., signatures that characterize the behavior of malware residing on a system. To this end, we develop AGIS, the first host-based technique that detects infections by novel malware and automatically generates an infection signature of the malware. AGIS monitors the runtime behavior of suspicious code according to a set of security policies to detect a previously undetected infection, and then identifies its characteristic behavior in terms of system or API calls. AGIS then statically analyzes the corresponding executables to extract the instructions important to the infection’s mission. These instructions can be used to build a template for a static-analysis-based scanner, or a regular-expression signature for legacy scanners. AGIS also detects encrypted malware and generates a signature from its plaintext decryption loop. We impl...
Zhuowei Li, XiaoFeng Wang, Zhenkai Liang, Michael
Added 29 May 2010
Updated 29 May 2010
Type Conference
Year 2008
Where DSN
Authors Zhuowei Li, XiaoFeng Wang, Zhenkai Liang, Michael K. Reiter
Comments (0)
books