Date of Award
6-14-2012
Document Type
Thesis
Degree Name
Master of Science in Computer Engineering
Department
Department of Electrical and Computer Engineering
First Advisor
Rusty O. Baldwin, PhD.
Abstract
The DoD relies on over seven million computing devices worldwide to accomplish a wide range of goals and missions. Malicious software, or malware, jeopardizes these goals and missions. However, determining whether an arbitrary software executable is malicious can be difficult. Obfuscation tools, called packers, are often used to hide the malicious intent of malware from anti-virus programs. Therefore detecting whether or not an arbitrary executable file is packed is a critical step in software security. This research uses machine learning methods to build a system, the Polymorphic and Non-Polymorphic Packer Detection (PNPD) system, that detects whether an executable is packed using both sequences of instructions, called i-grams, and disassembly information as features for machine learning. Both i-grams and disassembly features successfully detect packed executables with top configurations achieving average accuracies above 99.5\%, average true positive rates above 0.977, and average false positive rates below 1.6e-3 when detecting polymorphic packers.
AFIT Designator
AFIT-GCE-ENG-12-07
DTIC Accession Number
ADA563230
Recommended Citation
Gerics, Scott E., "Intra-procedural Path-insensitive Grams (i-grams) and Disassembly Based Features for Packer Tool Classification and Detection" (2012). Theses and Dissertations. 1109.
https://scholar.afit.edu/etd/1109