Malicious Codes Detection in Distributed Environments

Abstract : The thesis consists in two principal parts: the first one discusses the message for- mat extraction and the second one discusses the behavioral obfuscation of malwares and the detection. In the first part, we study the problem of “binary code coverage” and “input message format extraction”. For the first problem, we propose a new technique based on “smart” dynamic tainting analysis and reverse execution. For the second one, we propose a new method using an idea of classifying input message values by the corresponding execution traces received by executing the program with these input values. In the second part, we propose an abstract model for system calls interactions between malwares and the operating system at a host. We show that, in many cases, the behaviors of a malicious program can imitate ones of a benign program, and in these cases a behavioral detector cannot distinguish between the two programs
Document type :
Theses
Complete list of metadatas

Cited literature [150 references]  Display  Hide  Download

https://hal.univ-lorraine.fr/tel-01751547
Contributor : Thèses Ul <>
Submitted on : Thursday, March 29, 2018 - 1:21:27 PM
Last modification on : Tuesday, April 24, 2018 - 1:30:11 PM

File

DDOC_T_2015_0040_TA.pdf
Files produced by the author(s)

Identifiers

  • HAL Id : tel-01751547, version 1

Collections

Citation

Thanh Dinh Ta. Malicious Codes Detection in Distributed Environments. Other [cs.OH]. Université de Lorraine, 2015. English. ⟨NNT : 2015LORR0040⟩. ⟨tel-01751547⟩

Share

Metrics

Record views

28

Files downloads

86