Analyse de programmes malveillants par abstraction de comportements

Abstract : Traditional behavior analysis usually operates at the implementation level of malicious behaviors. Yet, it is mostly concerned with the identification of given functionalities and is therefore more naturally defined at a functional level. In this thesis, we define a form of program behavior analysis which operates on the function realized by a program rather than on its elementary interactions with the system. This function is extracted from program traces, a process we call abstraction. We define in a simple, intuitive and formal way the basic functionalities to abstract and the behaviors to detect, then we propose an abstraction mechanism applicable both to a static or to a dynamic analysis setting, with practical algorithms of reasonable complexity, finally we describe a behavior analysis technique integrating this abstraction mechanism. Our method is particularly suited to the analysis of programs written in high level languages or with a known source code, for which static analysis is facilitated: mobile applications for .NET or Java, scripts, browser addons, off-the-shelf components.The formalism we propose for behavior analysis by abstraction relies on the theory of string and terms rewriting, word and tree languages and model checking. It allows an efficient identification of functionalities in traces and thus the construction of a represen- tation of traces at a functional level; it defines functionalities and behaviors in a natural way, using temporal logic formulas, which assure their simplicity and their flexibility and enables the use of model checking techniques for behavior detection; it operates on an unrestricted set of execution traces; it handles the data flow in execution traces; and it allows the consideration of uncertainty in the identification of functionalities, with no complexity overhead. Experiments have been conducted in a dynamic and static analysis setting
Document type :
Theses
Complete list of metadatas

Cited literature [88 references]  Display  Hide  Download

https://hal.univ-lorraine.fr/tel-01751072
Contributor : Thèses Ul <>
Submitted on : Thursday, March 29, 2018 - 1:04:36 PM
Last modification on : Tuesday, April 24, 2018 - 1:30:11 PM

File

INPL_T_2011_BEAUCAMPS_P.pdf
Files produced by the author(s)

Identifiers

  • HAL Id : tel-01751072, version 1

Collections

Citation

Philippe Beaucamps. Analyse de programmes malveillants par abstraction de comportements. Autre [cs.OH]. Institut National Polytechnique de Lorraine, 2011. Français. ⟨NNT : 2011INPL092N⟩. ⟨tel-01751072⟩

Share

Metrics

Record views

79

Files downloads

81