Behavior Analysis of Malicious Code by Weighted Behavior Abstraction

Abstract. This work is a weighted generalization of the abstraction based analysis tech-nique we previously proposed for the detection of high-level malware behaviors. Our ap-proach, using a rewriting-based abstraction mechanism, produces abstracted forms of program traces, independent of the program implementation. The suspicious behaviors to be recognized, defined as combinations of patterns given in a signature, are detected by model-checking on the high-level representation of the program. Introducing weights in this approach allows us to express a pertinence degree of detection when analysis of the program results in an incomplete or uncertain program dataflow, or when abstraction cannot be performed reliably.