Implicit-Flow-Sensitive Method for Detection of Trojan-Spy Programs
DOI:
Author:
Affiliation:

Clc Number:

Fund Project:

  • Article
  • |
  • Figures
  • |
  • Metrics
  • |
  • Reference
  • |
  • Related
  • |
  • Cited by
  • |
  • Materials
  • |
  • Comments
    Abstract:

    In this paper, a novel method is presented to solve these problems. This method processes the X86 executable programs statically, so it has a higher code coverage than dynamic methods. Besides, it employs a data flow analysis method to identify the jump targets for indirect jumps. It also utilizes optimized tainting mark rules based on the operation semantic of branch conditions. Experiments on 103 real malwares and 7 benign softwares show that the proposed method has the following advantages: For Trojan-spy program detection, it can reduce the false negatives caused by the explicit-flow-sensitive method, and it is effective in dealing with information steal behaviors triggered by some particular conditions. For benign program analysis, it can reduce most of the tainted branches that should be tracked in the original implicit-flow-sensitive method without optimization.

    Reference
    Related
    Cited by
Get Citation

李佳静,梁知音,韦 韬,邹 维,毛 剑.一种隐式流敏感的木马间谍程序检测方法.软件学报,2010,21(6):1426-4137

Copy
Share
Article Metrics
  • Abstract:
  • PDF:
  • HTML:
  • Cited by:
History
  • Received:
  • Revised:
  • Adopted:
  • Online:
  • Published:
You are the firstVisitors
Copyright: Institute of Software, Chinese Academy of Sciences Beijing ICP No. 05046678-4
Address:4# South Fourth Street, Zhong Guan Cun, Beijing 100190,Postal Code:100190
Phone:010-62562563 Fax:010-62562533 Email:jos@iscas.ac.cn
Technical Support:Beijing Qinyun Technology Development Co., Ltd.

Beijing Public Network Security No. 11040202500063