D. Andriesse and H. Bos, An Analysis of the Zeus Peer-to-Peer Protocol

]. D. And+13, C. Andriesse, B. Rossow, D. Stone-gross, H. Plohmann et al., Highly Resilient Peer-to-Peer Botnets Are Here: An Analysis of Gameover Zeus, p.2013

D. Lee and . Dagon, From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based Malware, 2012.

[. Malware, Gen:Variant.Barys.159. 2013. url: http://goo.gl/YDC1o (cit, p.145

R. [. Barbosa and . Branco, Prevalent Characteristics in Modern Malware url: https://www.blackhat.com/docs/us-14/materials/us- 14-Branco-Prevalent-Characteristics-In-Modern-Malware.pdf (cit, 2014.

E. [. Bruening, S. Duesterwald, and . Amarasinghe, Design and Implementation of a Dynamic Optimization Framework for Windows, In: FDDO, 2001.

]. F. Bel14 and . Bellard, QEMU Open source processor emulator

D. [. Biondi and . Fabrice, Silver Needle in the Skype, 2006.

I. [. Beaucamps, J. Gnaedig, and . Marion, Behavior Abstraction in Malware Analysis, p.148
DOI : 10.1007/978-3-540-87403-4_5

URL : https://hal.archives-ouvertes.fr/inria-00536500

P. [. Bardin and . Herrmann, OSMOSE: automatic structural testing of executables, Software Testing, Verification and Reliability, vol.16, issue.1, 2011.
DOI : 10.1002/stvr.333

M. [. Bonfante, J. Kaczmarek, and . Marion, Morphological detection of malware, 2008 3rd International Conference on Malicious and Unwanted Software (MALWARE), 2008.
DOI : 10.1109/MALWARE.2008.4690851

URL : https://hal.archives-ouvertes.fr/inria-00330021

M. [. Bonfante, J. Kaczmarek, and . Marion, Architecture of a morphological malware detector, Journal in Computer Virology, vol.0, issue.4, pp.263-270, 2009.
DOI : 10.1007/s11416-008-0102-4

URL : https://hal.archives-ouvertes.fr/inria-00330022

M. [. Brosch and . Morgenstern, Runtime Packers: The Hidden Problem? url: https://www.blackhat.com/presentations/bh-usa-06/BH-US-06- Morgenstern.pdf (cit, 2006.

B. [. Bernat and . Miller, Anywhere, any-time binary instrumentation, Proceedings of the 10th ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools, PASTE '11, 2011.
DOI : 10.1145/2024569.2024572

R. [. Biswas and . Mall, Reverse execution of programs, ACM SIGPLAN Notices, vol.34, issue.4, pp.61-69, 1999.
DOI : 10.1145/312009.312079

J. [. Bonfante, T. T. Marion, and . Dinh, Efficient Program Exploration by Input Fuzzing, p.2013

G. Bonfante, J. Marion, and T. T. Dinh, Malware Message Analysis through Binary Traces, p.69

G. Bonfante, J. Marion, and T. T. Dinh, Malware Message Classification by Dynamic Analysis, p.69
DOI : 10.1007/978-3-319-17040-4_8

URL : https://hal.archives-ouvertes.fr/hal-01099692

D. [. Bryant and . O-'hallaron, Computer Systems: A Programmer's Perspective, pp.69-78, 2008.

D. [. Babi, D. Reynaud, and . Song, Malware Analysis with Tree Automata Inference, 2011.
DOI : 10.1016/S0022-0000(72)80020-5

]. D. Bru+08, C. Brumley, Z. Hartwig, J. Liang, D. Newsome et al., Automatically Identifying Trigger-based Behavior in Malware " . In: Botnet Analysis and Defense, pp.65-88, 2008.

]. D. Bru+11, I. Brumley, T. Jager, E. J. Avgerinos, and . Schwartz, BAP: A Binary Analysis Platform, 2011.

]. G. Bru10, . Bruneau, and . Sinkhole, url: http : / / www . sans . org / reading-room/whitepapers, p.33523, 2010.

]. J. Cab+07, H. Caballero, Z. Yin, D. Liang, and . Song, Polyglot: Automatic Extraction of Protocol Message Format using Dynamic Binary Analysis, CCS, vol.7, issue.118, pp.20-22, 2007.

]. J. Cab+09, P. Caballero, C. Poosankam, D. X. Kreibich, and . Song, Dispatcher: Enabling Active Botnet Infiltration Using Automatic Protocol Reverse- Engineering, CCS, vol.7, issue.118, pp.16-18, 2009.

]. C. Cad+06, V. Cadar, P. M. Ganesh, D. L. Pawlowski, D. R. Dill et al., EXE: Automatically Generating Inputs of Death, CCS, 2006.

R. [. Cousot and . Cousot, Abstract interpretation, Proceedings of the 4th ACM SIGACT-SIGPLAN symposium on Principles of programming languages , POPL '77, 1977.
DOI : 10.1145/512950.512973

URL : https://hal.archives-ouvertes.fr/hal-01108790

J. [. Chikofsky and . Cross, Reverse engineering and design recovery: a taxonomy, IEEE Software, vol.7, issue.1, pp.13-17, 1990.
DOI : 10.1109/52.43044

C. [. Calvet, P. Davis, and . Bureau, Malware authors don't learn, and that's good!, 2009 4th International Conference on Malicious and Unwanted Software (MALWARE), 2009.
DOI : 10.1109/MALWARE.2009.5403013

J. [. Calvet, J. Fernandez, and . Marion, Aligot, Proceedings of the 2012 ACM conference on Computer and communications security, CCS '12, p.2012
DOI : 10.1145/2382196.2382217

URL : https://hal.archives-ouvertes.fr/hal-00762924

]. M. Chr+05, S. Christodorescu, S. A. Jha, D. Seshia, R. E. Song et al., Semantics- Aware Malware Detection, p.152, 2005.

S. [. Christodorescu and . Jha, Static Analysis of Executables to Detect Malicious Patterns, In: SSYM, 2003.
DOI : 10.21236/ADA449067

C. [. Christodorescu, S. Kruegel, and . Jha, Mining Specifications of Malicious Behavior, pp.5-14, 2007.

W. Cui, J. Kannan, and H. J. Wang, Discoverer: Automatic Protocol Reverse Engineering from Network Traces, pp.17-19, 2007.

W. [. Clause, A. Li, and . Orso, Dytan, Proceedings of the 2007 international symposium on Software testing and analysis, ISSTA '07, 2007.
DOI : 10.1145/1273463.1273490

J. [. Collberg and . Nagra, Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection, 2009.

]. P. Com+09, G. Comparetti, C. Wondracek, E. Krügel, and . Kirda, Prospex: Protocol Specification Extraction, pp.99-110, 2009.

]. K. Coo+09, S. K. Coogan, T. Debray, G. M. Kaochar, and . Townsend, Automatic Static Unpacking of Malware Binaries, WCRE, 2009.

]. S. Coo71 and . Cook, The Complexity of Theorem-Proving Procedures, 1971.

D. [. Caballero and . Song, Automatic protocol reverse-engineering: Message format extraction and field semantics inference, Computer Networks 57, pp.451-474, 2013.
DOI : 10.1016/j.comnet.2012.08.003

URL : http://www.cs.berkeley.edu/%7Edawnsong/papers/2012%20Automatic%20Protocol%20Reverse%20Engineering.pdf

Z. [. Cai, A. Shao, and . Vaynberg, Certified Self-Modifying Code, 2007.
DOI : 10.1145/1250734.1250743

URL : http://flint.cs.yale.edu/flint/publications/smctr.pdf

C. [. Collberg and . Thomborson, Watermarking, Tamper-proffing, and Obfuscation: Tools for Software Protection, 2002.

C. [. Collberg, D. Thomborson, and . Low, A Taxonomy of Obfuscating Transformations, 1997.

]. M. Dal+07, M. Preda, S. Christodorescu, S. Jha, and . Debray, A Semantics- Based Approach to Malware Detection, 2007.

]. M. Dal+10, R. Dalla-preda, S. K. Giacobazzi, K. Debray, G. M. Coogan et al., Modelling Metamorphism by Abstract Interpretation

]. M. Dal07 and . Preda, Code Obfuscation and Malware Detection by Abstract Interpretation, 2007.

]. M. Dal12 and . Preda, The Grand Challenge in Metamorphic Analysis, ICISTM. 2012, pp.439-444

]. E. Dav14 and . David, Kaspersky Security Bulletin 2014 Malware Evolution url: https : / / securelist . com / files Kaspersky -Security - Bulletin-2014-Malware-Evolution.pdf (cit, p.18, 2014.

[. Preda and R. Giacobazzi, Semantics-based Code Obfuscation by Abstract Interpretation, JCS, vol.176, 2009.

A. [. Dang, E. Gazet, and . Bachaalany, Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation, p.2014

]. S. Dol13 and . Dolan, mov is Turing-complete, p.151

[. Malware, Trojan-Dropper.Win32.Dorgam.un. 2013. url: http:// goo.gl/3e1AR (cit, pp.127-145

S. [. Dullien and . Porst, REIL: A platform-independent intermediate representation of disassembled code for static code analysis, 2009.

J. [. Debray and . Patel, Reverse Engineering Self-Modifying Code: Unpacker Extraction, 2010 17th Working Conference on Reverse Engineering, 2010.
DOI : 10.1109/WCRE.2010.22

]. M. Ege+12, T. Egele, E. Scholte, C. Kirda, and . Kruegel, A Survey On Automated Dynamic Malware-Analysis Techniques and Tools, In: ACM Computing Survey, vol.44, issue.2, 2012.

]. M. Erw08 and . Erwig, FGL/Haskell -A Functional Graph Library for Haskell, p.145, 2008.

E. [. Falliere and . Chien, Zeus: King of the Bots

M. [. Fredrikson, S. Christodorescu, and . Jha, Dynamic Behavior Matching: A Complexity Analysis and New Approximation Algorithms, pp.252-267, 2011.
DOI : 10.1007/978-0-387-79420-4_15

]. P. Fer11 and . Ferrie, The Ultimate Anti-Debugging Reference, p.14

]. E. Fil07 and . Filiol, Formalisation and implementation aspects of ?-ary (malicious) codes, In: Journal in Computer Virology, vol.32, pp.75-86, 2007.

]. S. For+96, S. A. Forrest, A. Hofmeyr, T. A. Somayaji, and . Longstaff, A Sense of Self for Unix Processes, pp.120-128, 1996.

N. [. Falcon and . Riva, Dynamic Binary Instrumentation Frameworks: I know you're there spying on me, 2012.

]. M. Fre+10, S. Fredrikson, M. Jha, R. Christodorescu, X. Sailer et al., Synthesizing Near-Optimal Malware Specifications from Suspicious Behaviors, p.148, 2010.

S. [. Fritzler and . Werndorfer, UnOfficial AIM/OSCAR Protocol Specification, 2000.

]. E. Gan+93, E. Gansner, S. C. Koutsofios, P. North, and . Vo, A Technique for Drawing Directed Graphs, IEEE Transactions on Software Engineering, 1993.

P. [. Guo, T. Ferrie, and . Chiueh, A Study of the Packer Problem and Its Solutions, In: RAID, vol.12, p.13, 2008.
DOI : 10.1007/978-3-540-87403-4_6

N. [. Godefroid, K. Klarlund, and . Sen, DART: Directed Automated Random Testing, PLDI. 2005 (cit. on pp. 16

]. R. Gla01 and . Glabbeek, The Linear Time ? Branching Time Spectrum I: The Semantics of Concrete, Sequential Processes, Handbook of Process Algebra, pp.3-99, 2001.

M. [. Godefroid, D. Levin, and . Molnar, Automated Whitebox Fuzz Testing, pp.151-166, 2008.

]. C. Gom+08, H. Gomes, A. Kautz, B. Sabharwal, and . Selman, Satisfiability Solvers, Handbook of Knowledge Representation, vol.3, pp.89-134, 2008.

. Graphviz, Graph Visualization Software, 2014.

K. Great and . Lab, The Mystery of the Encrypted Gauss Payload, 2013.

]. K. Haz11 and . Hazelwood, Dynamic Binary Modification: Tools, Techniques, and Applications, 2011.

N. [. Horspool and . Marovac, An Approach to the Problem of Detranslation of Computer Programs, The Computer Journal, vol.23, issue.3, pp.223-229, 1980.
DOI : 10.1093/comjnl/23.3.223

J. E. Hopcroft, R. Motwani, and J. D. Ullman, Introduction to Automata Theory, Languages, and Computation, p.52, 2007.

J. [. Hell and . Nesetril, Graphs and Homomorphisms, 2004.
DOI : 10.1093/acprof:oso/9780198528173.001.0001

C. [. Hahn and . Tardif, Graph homomorphisms: structure and symmetry, Graph Symmetry, pp.107-166, 1997.
DOI : 10.1007/978-94-015-8937-6_4

. Ioactive, Reversal and Analysis of Zeus and SpyEye Banking Trojans

]. N. Jon97 and . Jones, Computability and Complexity -from a Programming Perspective, 1997.

R. [. Joyal and . Street, The geometry of tensor calculus, I, Advances in Mathematics, vol.88, issue.1, pp.55-112, 1991.
DOI : 10.1016/0001-8708(91)90003-P

]. V. Kem+12, G. Kemerlis, K. Portokalidis, A. D. Jee, and . Keromytis, libdft: Practical Dynamic Data Flow Tracking for Commodity Systems

]. J. Kin76 and . King, Symbolic Execution and Program Testing, In: CACM, vol.197, issue.17, pp.385-394, 1976.

H. [. Knuth, V. James, and . Pratt, Fast Pattern Matching in Strings, SIAM Journal on Computing, vol.6, issue.2, 1977.
DOI : 10.1137/0206024

M. [. Kolter and . Maloof, Learning to Detect and Classify Malicious Executables in the Wild, Journal of Machine Learning Research, vol.6, 2006.

. Wang, Effective and Efficient Malware Detection at the End Host, pp.351-366, 2009.

]. D. Koz97 and . Kozen, Automata and Computability, 1997.

P. [. Kang, H. Poosankam, and . Yin, Renovo, Proceedings of the 2007 ACM workshop on Recurring malcode, WORM '07, 2007.
DOI : 10.1145/1314389.1314399

P. [. Kholia and . Wegrzyn, Looking Inside the (Drop) Box

T. [. Lee, D. Avgerinos, and . Brumley, TIE: Principled Reverse Engineering of Types in Binary Programs, In: NDSS, 2011.

]. K. Lab12b and . Lab, Gauss: Abnormal Distribution

]. D. Lab12c and . Labs, A New Iteration of the TDSS/TDL4 Malware Using DGA-based Command-and-Control

J. [. Lee, S. Alves-foss, and . Harrison, The Use of Encrypted Functions for Mobile Agent Security, 2004.

]. J. Lam85 and . Lambek, Cartesian Closed Categories and Typed Lambda-calculi, Combinators and Functional Programming Languages, pp.136-175, 1985.

S. [. Linn and . Debray, Obfuscation of executable code to improve resistance to static disassembly, Proceedings of the 10th ACM conference on Computer and communication security , CCS '03, 2003.
DOI : 10.1145/948109.948149

]. T. Lec97 and . Lecroq, Knuth-Morris-Pratt algorithm, 1997.

]. Z. Lin+08, X. Lin, D. Jiang, X. Xu, and . Zhang, Automatic Protocol Format Reverse Engineering through Context-Aware Monitored Execution, p.118, 2008.

]. Luk+05 and . Luk, Pin: Building Customized Program Analysis Tools with Dynamic Instrumentation, p.145, 2005.

]. N. Lut08 and . Lutz, Towards Revealing Attackers' Intent by Automatically Decrypting Network Traffic, 2008.

X. [. Lin, D. Zhang, and . Xu, Automatic Reverse Engineering of Data Structures from Binary Execution, In: NDSS, 2010.

]. W. Ma+12, P. Ma, S. Duan, G. Liu, J. Gu et al., Shadow attacks: automatically evading system-call-behavior based malware detection, pp.1-13, 2012.

]. A. Mar08 and . Martin, Anti analysis tricks in Trojan-Downloader.Win32.Agent.abti, 2008.

]. M. Mat+13, J. Matz, A. Hubika, M. Jaeger, and . Mitchell, System V Application Binary Interface, pp.69-78, 2013.

. Mcafee, . Mcafee-labsthreats, and . Report, url: http://www.mcafee. com/us/resources/reports/rp-quarterly-threat-q2-2014.pdf (cit, p.18, 2014.

]. O. Med12 and . Medegan, Skype Reverse. 2012. url: http://www.oklabs.net/category/ skype-reverse

]. R. Mil99 and . Milner, Communicating and mobile systems: the ?-calculus, pp.38-59, 1999.

]. A. Mkk07a, C. Moser, E. Kruegel, and . Kirda, Limits of Static Analysis for Malware Detection, In: ACSAC, 2007.

]. A. Mkk07b, C. Moser, E. Krügel, and . Kirda, Exploring Multiple Execution Paths for Malware Analysis, pp.100-102

U. [. Meseguer and . Montanari, Petri nets are monoids, Information and Computation, vol.88, issue.2, pp.105-155, 1990.
DOI : 10.1016/0890-5401(90)90013-8

URL : https://doi.org/10.1016/0890-5401(90)90013-8

R. [. Metcalf and . Simon, Neutralize Advanced Threats

]. C. Nac97 and . Nachenberg, Computer Virus-Antivirus Coevolution, In: CACM, vol.401, pp.46-51, 1997.

D. [. Newsome and . Song, Dynamic Taint Analysis for Automatic Detection , Analysis, and Signature Generation of Exploits on Commodity Software, In: NDSS, 2005.

J. [. Nethercote and . Seward, Valgrind: A Framework for Heavyweight Dynamic Binary Instrumentation, 2007.

C. [. Needleman and . Wunsch, A General Method Applicable to the Search for Similarities in the Amino Acid Sequence of Two Proteins, Journal of Molecular Biology, vol.483, pp.443-453, 1970.

L. [. Oberhumer, J. Molnar, and . Reiser, Ultimate Packer for eXecutables, 2013.

]. T. Orm11 and . Ormandy, Sophail: A Critical Analysis of Sophos Antivirus url: https, 2011.

. Pandalabs, Quarterly Report PandaLabs url: http://mediacenter. pandasecurity . com / mediacenter / wp -content / uploads, 2014.

]. A. Pnu85 and . Pnueli, Linear and Branching Structures in the Semantics and Logics of Reactive Systems, p.37, 1985.

T. [. Péchoux and . Ta, A Categorical Treatment of Malicious Behavioral Obfuscation, p.125
DOI : 10.1007/978-3-319-06089-7_20

M. [. Ramilli and . Bishop, Multi-stage delivery of malware, 2010 5th International Conference on Malicious and Unwanted Software, 2010.
DOI : 10.1109/MALWARE.2010.5665788

]. T. Rep+10, J. Reps, A. Lim, G. Thakur, A. Balakrishnan et al., There's Plenty of Room at the Bottom: Analyzing and Verifying Machine Code, p.2010

]. S. Res11a and . Response, Duqu -The precursor to the next Stuxnet, 2011.

]. S. Res14 and . Response, Regin: Top-tier espionage tool enables stealthy surveillance

]. H. Ric53 and . Rice, Classes of Recursively Enumerable Sets and Their Decision Problems, In: Trans. Amer. Math. Soc, vol.74, pp.358-366, 1953.

]. K. Rie+11, P. Rieck, C. Trinius, T. Willems, and . Holz, Automatic Analysis of Malware Behavior using Machine Learning, Journal of Computer Security, vol.194, 2011.

B. [. Roundy and . Miller, Binary-code obfuscations in prevalent packer tools, ACM Computing Surveys, vol.46, issue.1, 2013.
DOI : 10.1145/2522968.2522972

]. P. Roy+06, M. Royal, D. Halpin, R. Dagon, W. Edmonds et al., PolyUnpack: Automating the Hidden-Code Extraction of Unpack-Executing Malware, In: ACSAC, p.14, 2006.

T. [. Schwartz, D. Avgerinos, and . Brumley, All You Ever Wanted to Know About Dynamic Taint Analysis and Forward Symbolic Execution, SSP, 2010.

]. D. San09 and . Sangiorgi, On the Origins of Bisimulation and Coinduction, TOPLAS 31, pp.38-54, 2009.

S. [. Schwarz, G. Debray, and . Andrews, Disassembly of executable code revisited, Ninth Working Conference on Reverse Engineering, 2002. Proceedings., p.72, 2002.
DOI : 10.1109/WCRE.2002.1173063

]. P. Sel09 and . Selinger, A survey of graphical languages for monoidal categories, pp.143-144, 2009.

P. [. Ször and . Ferrie, Hunting For Metamorphic, 2001.

A. [. Sutton, P. Greene, and . Amini, Fuzzing: Brute Force Vulnerability Discovery, 2007.

A. [. Sikorski and . Honig, Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software, p.2012

]. M. Sha+08, A. Sharif, J. T. Lanzi, W. Giffin, and . Lee, Impeding Malware Analysis Using Conditional Code Obfuscation, 2008.

]. T. Shi09 and . Shields, Anti-Debugging -A Developer's View, 2009.

]. H. Sim96 and . Simon, The Sciences of the Artificial. 3rd, 1996.

]. M. Sip05 and . Sipser, Introduction to the Theory of Computation, 2005.

]. A. Ska+10, T. Skaletsky, N. Devor, R. Chachmon, K. Cohn et al., Dynamic Program Analysis of Microsoft Windows Applications

]. D. Son+08 and . Song, BitBlaze: A New Approach to Computer Security via Binary Analysis, In: ICISS, 2008.

T. [. Song and . Touili, Efficient Malware Detection Using Model-Checking, In: FM, vol.2012
DOI : 10.1007/978-3-642-32759-9_34

URL : http://www.liafa.jussieu.fr/~song/FM12.pdf

C. [. Sander and . Tschudin, Protecting Mobile Agents Against Malicious Hosts, 1998.
DOI : 10.1007/3-540-68671-1_4

]. P. Szo05 and . Szor, The Art of Computer Virus Research and Defense, 2005.

]. T. Tha13 and . Dinh, Trace Transformation Tool. 2013. url: http://goo.gl/rqCSQ (cit, p.145

]. A. Tri03 and . Tridgell, How Samba was written url: https, 2003.

]. C. Wan+01, J. Wang, J. Davidson, J. Hill, and . Knight, Protection of Software-based Survivability Mechanisms, 2001.

]. Z. Wan+09, X. Wang, W. Jiang, X. Cui, M. Wang et al., ReFormat: Automatic Reverse Engineering of Encrypted Messages, ESORICS, 2009.

]. H. Wee05 and . Wee, On Obfuscating Point Functions, 2005.

G. Wondracek, P. M. Comparetti, C. Krügel, and E. Kirda, Automatic Network Protocol Analysis, p.150, 2008.

P. [. Wagner and . Soto, Mimicry attacks on host-based intrusion detection systems, Proceedings of the 9th ACM conference on Computer and communications security , CCS '02, pp.255-264, 2002.
DOI : 10.1145/586110.586145

Z. [. Yan, N. Zhang, and . Ansari, Revealing Packed Malware, IEEE Security & Privacy Magazine, vol.6, issue.5, pp.65-69, 2008.
DOI : 10.1109/MSP.2008.126