TY - GEN
T1 - Malware detection method focusing on anti-debugging functions
AU - Yoshizaki, Kota
AU - Yamauchi, Toshihiro
PY - 2015/2/27
Y1 - 2015/2/27
N2 - Malware has received much attention in recent years. Antivirus software is widely used as a countermeasure against malware. However, some kinds of malware can evade detection by antivirus software, hence, a new detection method is required. In this paper, we propose a malware detection method that focuses on Anti-Debugging functions. An Anti-Debugging function is a method that prevents malware analysts from analyzing an application program (AP). The function can form part of benign as well as malicious APs. Our method focuses on a behavioral difference between benign and malicious APs and detects malware by comparing the two behavioral patterns. Evaluation results with malware confirmed our method to be capable of successfully detecting malware.
AB - Malware has received much attention in recent years. Antivirus software is widely used as a countermeasure against malware. However, some kinds of malware can evade detection by antivirus software, hence, a new detection method is required. In this paper, we propose a malware detection method that focuses on Anti-Debugging functions. An Anti-Debugging function is a method that prevents malware analysts from analyzing an application program (AP). The function can form part of benign as well as malicious APs. Our method focuses on a behavioral difference between benign and malicious APs and detects malware by comparing the two behavioral patterns. Evaluation results with malware confirmed our method to be capable of successfully detecting malware.
KW - Anti-debugging
KW - Malware detection
KW - Security
UR - http://www.scopus.com/inward/record.url?scp=84925423413&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84925423413&partnerID=8YFLogxK
U2 - 10.1109/CANDAR.2014.36
DO - 10.1109/CANDAR.2014.36
M3 - Conference contribution
AN - SCOPUS:84925423413
T3 - Proceedings - 2014 2nd International Symposium on Computing and Networking, CANDAR 2014
SP - 563
EP - 566
BT - Proceedings - 2014 2nd International Symposium on Computing and Networking, CANDAR 2014
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 2nd International Symposium on Computing and Networking, CANDAR 2014
Y2 - 10 December 2014 through 12 December 2014
ER -