Scalable code clone search for malware analysis. (December 2015)

• Record Type: Journal Article
• Authors: Farhadi, Mohammad Reza; Fung, Benjamin C.M.; Fung, Yin Bun; Charland, Philippe; Preda, Stere; Debbabi, Mourad
• Is Part Of: Digital investigation. Volume 15(2015)
• Page Start: 46
• Page End: 60
• Publication Date: 2015-12
• Subjects: Assembly code clone detection -- Malware analysis -- Reverse engineering -- Software fingerprinting -- Software security; Forensic sciences -- Data processing -- Periodicals; Criminal investigation -- Data processing -- Periodicals; 363.250285
• DOI: 10.1016/j.diin.2015.06.001
• Languages: English
• ISSNs: 1742-2876

Abstract

Abstract: Reverse engineering is the primary step to analyze a piece of malware. After having disassembled a malware binary, a reverse engineer needs to spend extensive effort analyzing the resulting assembly code, and then documenting it through comments in the assembly code for future references. In this paper, we have developed an assembly code clone search system called ScalClone based on our previous work on assembly code clone detection systems. The objective of the system is to identify the code clones of a target malware from a collection of previously analyzed malware binaries. Our new contributions are summarized as follows: First, we introduce two assembly code clone search methods for malware analysis with a high recall rate. Second, our methods allow malware analysts to discover both exact and inexact clones at different token normalization levels. Third, we present a scalable system with a database model to support large-scale assembly code search. Finally, experimental results on real-life malware binaries suggest that our proposed methods can effectively identify assembly code clones with the consideration of different scenarios of code mutations.