Earticle

초록

영어

Protecting data and applications from malware and other forms of malicious code has assumed a great relevance in the current era of pervasive web-based applications. Attackers often use code obfuscation to hide harmful programs from automatic detection. Several researchers have proposed methods to classify an unknown program as malicious or benign; however, little work has been done to identify obfuscated code. A promising approach to detect obfuscated code consists of using a set of metrics, collected by static analysis, to classify a program. In this paper we present an empirical evaluation of three text-based metrics to identify obfuscated code. Our experiment shows that the effectiveness of these metrics depends on the obfuscators: there are cases in which the metrics allow the proliferation of false positives (i.e., misclassification of clear code as obfuscated code), which is bothering but not dangerous, and cases where false negatives (i.e. misclassification of obfuscated as clear code) proliferate, which is definitely more dangerous. Based on our experiment, we propose a combination of these three metrics and show how this combination outperforms the individual metrics.

목차

Abstract
 1. Introduction
 2. Related Works
 3. Metrics for Detecting Obfuscated Code
  3.1. N-gram
  3.2. Entropy
  3.3. Wordsize
 4. The Experiment
  4.1. Experiment Organization
  4.2. Descriptive Statistics of Results
  4.3. Analysis of Aggregated Metrics
  4.4. Test of the Hypotheses
  4.5. Size Effect Analysis
 5. Conclusion
 References

키워드

저자

• Corrado Aaron Visaggio [ Department of Engineering, University of Sannio ]
• Giuseppe Antonio Pagin [ Department of Engineering, University of Sannio ]
• Gerardo Canfora [ Department of Engineering, University of Sannio ]

참고문헌

발행기관

간행물

표지보기 관심저널 등록

• 간행물명

  International Journal of Security and Its Applications

• 간기

  격월간

• pISSN

  1738-9976

• 수록기간

  2008~2016

• 등재여부

  SCOPUS

• 십진분류

  KDC 505 DDC 605