An Analysis of the Zeus Peer-to-Peer Protocol, 2014. ,
Highly resilient peer-to-peer botnets are here: An analysis of Gameover Zeus, 2013 8th International Conference on Malicious and Unwanted Software: "The Americas" (MALWARE), p.2013 ,
DOI : 10.1109/MALWARE.2013.6703693
From Throw-Away Traffic to Bots: Detecting the Rise of DGA- Based Malware ,
Category Theory Oxford Logic Guides, 2010. ,
Prevalent Characteristics in Modern Malware url: https : / / www . blackhat . com / docs / us -14 / materials / us -14 - Branco-Prevalent-Characteristics-In-Modern-Malware.pdf (cit, 2014. ,
OSMOSE: automatic structural testing of executables, Software Testing, Verification and Reliability, vol.16, issue.1, 2011. ,
DOI : 10.1002/stvr.423
Behavior Abstraction in Malware Analysis ,
DOI : 10.1007/978-3-642-16612-9_14
URL : https://hal.archives-ouvertes.fr/inria-00536500
QEMU Open source processor emulator ,
Anywhere, any-time binary instrumentation, Proceedings of the 10th ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools, PASTE '11, 2011. ,
DOI : 10.1145/2024569.2024572
Silver Needle in the Skype, 2006. ,
Reverse execution of programs, ACM SIGPLAN Notices, vol.34, issue.4, pp.61-69, 1999. ,
DOI : 10.1145/312009.312079
Morphological detection of malware, 2008 3rd International Conference on Malicious and Unwanted Software (MALWARE), 2008. ,
DOI : 10.1109/MALWARE.2008.4690851
URL : https://hal.archives-ouvertes.fr/inria-00330021
Architecture of a morphological malware detector, Journal in Computer Virology, vol.0, issue.4, pp.263-270, 2009. ,
DOI : 10.1007/s11416-008-0102-4
URL : https://hal.archives-ouvertes.fr/inria-00330022
url: https://github. com/tathanhdinh/PathExplorer (cit, p.100 ,
Efficient Program Exploration by Input Fuzzing ,
Malware Message Analysis through Binary Traces, p.69 ,
Malware Message Classification by Dynamic Analysis, p.69 ,
DOI : 10.1007/978-3-319-17040-4_8
URL : https://hal.archives-ouvertes.fr/hal-01099692
Runtime Packers: The Hidden Problem? url: https : / / www . blackhat . com / presentations / bh -usa -06 / BH -US -06 - Morgenstern.pdf (cit, 2006. ,
Design and Implementation of a Dynamic Optimization Framework for Windows, In: FDDO, 2001. ,
Automatically Identifying Trigger-based Behavior in Malware, Botnet Analysis and Defense, pp.65-88, 2008. ,
DOI : 10.1007/978-0-387-68768-1_4
BAP: A Binary Analysis Platform, 2011. ,
DOI : 10.1007/978-3-642-14295-6_27
url: http://www.sans.org/reading- room, p.33523, 2010. ,
Computer Systems: A Programmer's Perspective, pp.69-78, 2008. ,
Dispatcher, Proceedings of the 16th ACM conference on Computer and communications security, CCS '09, pp.16-18, 2009. ,
DOI : 10.1145/1653662.1653737
Automatic protocol reverse-engineering: Message format extraction and field semantics inference, Computer Networks 57, pp.451-474, 2013. ,
DOI : 10.1016/j.comnet.2012.08.003
Polyglot, Proceedings of the 14th ACM conference on Computer and communications security , CCS '07, pp.19-22, 2007. ,
DOI : 10.1145/1315245.1315286
EXE: Automatically Generating Inputs of Death, CCS, 2006. ,
Certified Self-Modifying Code, 2007. ,
Malware authors don't learn, and that's good!, 2009 4th International Conference on Malicious and Unwanted Software (MALWARE), 2009. ,
DOI : 10.1109/MALWARE.2009.5403013
Aligot, Proceedings of the 2012 ACM conference on Computer and communications security, CCS '12, p.2012 ,
DOI : 10.1145/2382196.2382217
URL : https://hal.archives-ouvertes.fr/hal-00762924
Reverse engineering and design recovery: a taxonomy, IEEE Software, vol.7, issue.1, pp.13-17, 1990. ,
DOI : 10.1109/52.43044
Static Analysis of Executables to Detect Malicious Patterns, 2003. ,
Semantics-Aware Malware Detection, 2005 IEEE Symposium on Security and Privacy (S&P'05), p.154 ,
DOI : 10.1109/SP.2005.20
Mining Specifications of Malicious Behavior, pp.5-14, 2007. ,
Dytan, Proceedings of the 2007 international symposium on Software testing and analysis, ISSTA '07, 2007. ,
DOI : 10.1145/1273463.1273490
Watermarking, Tamper-proffing, and Obfuscation: Tools for Software Protection, 2002. ,
Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection. 1st, 2009. ,
A Taxonomy of Obfuscating Transformations, 1997. ,
Prospex: Protocol Specification Extraction, 2009 30th IEEE Symposium on Security and Privacy, pp.111-118, 2009. ,
DOI : 10.1109/SP.2009.14
Automatic Static Unpacking of Malware Binaries, 2009 16th Working Conference on Reverse Engineering, 2009. ,
DOI : 10.1109/WCRE.2009.24
The complexity of theorem-proving procedures, Proceedings of the third annual ACM symposium on Theory of computing , STOC '71, 1971. ,
DOI : 10.1145/800157.805047
Abstract interpretation, Proceedings of the 4th ACM SIGACT-SIGPLAN symposium on Principles of programming languages , POPL '77, 1977. ,
DOI : 10.1145/512950.512973
URL : https://hal.archives-ouvertes.fr/hal-01108790
Discoverer: Automatic Protocol Reverse Engineering from Network Traces, pp.17-19, 2007. ,
Code Obfuscation and Malware Detection by Abstract Interpretation, 2007. ,
The Grand Challenge in Metamorphic Analysis, pp.439-444 ,
URL : https://hal.archives-ouvertes.fr/hal-00909386
A Semantics-Based Approach to Malware Detection, p.125, 2007. ,
Semantics-based Code Obfuscation by Abstract Interpretation, JCS, vol.176, 2009. ,
Modelling Metamorphism by Abstract Interpretation ,
Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation, p.2014 ,
Kaspersky Security Bulletin 2014. Malware Evolution. 2014. url: https ,
Reverse Engineering Self-Modifying Code: Unpacker Extraction, 2010 17th Working Conference on Reverse Engineering, 2010. ,
DOI : 10.1109/WCRE.2010.22
mov is Turing-complete, p.153 ,
REIL: A platform-independent intermediate representation of disassembled code for static code analysis, 2009. ,
A survey on automated dynamic malware-analysis techniques and tools, ACM Computing Surveys, vol.44, issue.2, 2012. ,
DOI : 10.1145/2089125.2089126
FGL/Haskell -A Functional Graph Library for Haskell, 2008. ,
Dynamic Binary Instrumentation Frameworks: I know you're there spying on me, 2012. ,
Zeus: King of the Bots ,
The Ultimate Anti-Debugging Reference, p.14 ,
Formalisation and implementation aspects of K-ary (malicious) codes, Journal in Computer Virology, vol.47, issue.6, pp.75-86, 2007. ,
DOI : 10.1007/s11416-007-0044-2
A sense of self for Unix processes, Proceedings 1996 IEEE Symposium on Security and Privacy, pp.120-128, 1996. ,
DOI : 10.1109/SECPRI.1996.502675
Synthesizing Near-Optimal Malware Specifications from Suspicious Behaviors, 2010 IEEE Symposium on Security and Privacy, 2010. ,
DOI : 10.1109/SP.2010.11
UnOfficial AIM/OSCAR Protocol Specification, 2000. ,
A technique for drawing directed graphs, IEEE Transactions on Software Engineering, vol.19, issue.3, 1993. ,
DOI : 10.1109/32.221135
The linear time ??? Branching time spectrum II, Handbook of Process Algebra, pp.3-99, 2001. ,
DOI : 10.1007/3-540-57208-2_6
DART: Directed Automated Random Testing, PLDI. 2005 (cit. on pp. 16 ,
Automated Whitebox Fuzz Testing, pp.151-166, 2008. ,
Chapter 2 Satisfiability Solvers, Satisfiability Solvers " . In: Handbook of Knowledge Representation, vol.3, pp.89-134, 2008. ,
DOI : 10.1016/S1574-6526(07)03002-7
Graph Visualization Software, 2014. ,
The Mystery of the Encrypted Gauss Payload, 2013. ,
A Study of the Packer Problem and Its Solutions, In: RAID, vol.12, p.13, 2008. ,
DOI : 10.1007/978-3-540-87403-4_6
Graph homomorphisms: structure and symmetry, Graph Symmetry, pp.107-166, 1997. ,
DOI : 10.1007/978-94-015-8937-6_4
Dynamic Binary Modification: Tools, Techniques, and Applications, Synthesis Lectures on Computer Architecture, vol.6, issue.2, 2011. ,
DOI : 10.2200/S00345ED1V01Y201104CAC015
Graphs and Homomorphisms, 2004. ,
DOI : 10.1093/acprof:oso/9780198528173.001.0001
Introduction to Automata Theory, Languages, and Computation, p.52, 2007. ,
An Approach to the Problem of Detranslation of Computer Programs, The Computer Journal, vol.23, issue.3, pp.223-229, 1980. ,
DOI : 10.1093/comjnl/23.3.223
Reversal and Analysis of Zeus and SpyEye Banking Trojans ,
Computability and Complexity from a Programming Perspective, 1997. ,
DOI : 10.1007/978-94-010-0413-8_4
The geometry of tensor calculus, I, Advances in Mathematics, vol.88, issue.1, pp.55-112, 1991. ,
DOI : 10.1016/0001-8708(91)90003-P
Renovo, Proceedings of the 2007 ACM workshop on Recurring malcode, WORM '07, 2007. ,
DOI : 10.1145/1314389.1314399
libdft: Practical Dynamic Data Flow Tracking for Commodity Systems ,
Looking Inside the (Drop) Box ,
Symbolic execution and program testing, Communications of the ACM, vol.19, issue.7, pp.385-394, 1976. ,
DOI : 10.1145/360248.360252
Fast Pattern Matching in Strings, SIAM Journal on Computing, vol.6, issue.2, 1977. ,
DOI : 10.1137/0206024
Effective and Efficient Malware Detection at the End Host, pp.351-366, 2009. ,
Learning to Detect and Classify Malicious Executables in the Wild, Journal of Machine Learning Research, vol.6, 2006. ,
Automata and Computability, p.73, 1997. ,
sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex malware for targeted attacks, Tech. rep. Budapest University of Technology and Economics, p.2012 ,
Gauss: Abnormal Distribution ,
A New Iteration of the TDSS/TDL4 Malware Using DGA-based Commandand-Control ,
Links Web Browser, 2014. ,
Cartesian Closed Categories and Typed Lambda-calculi " . In: Combinators and Functional Programming Languages, pp.136-175, 1985. ,
Knuth-Morris-Pratt algorithm, 1997. ,
The Use of Encrypted Functions for Mobile Agent Security, In: HICSS, 2004. ,
TIE: Principled Reverse Engineering of Types in Binary Programs, In: NDSS, 2011. ,
Automatic Protocol Format Reverse Engineering through Context-Aware Monitored Execution, p.118, 2008. ,
Automatic Reverse Engineering of Data Structures from Binary Execution ,
Obfuscation of executable code to improve resistance to static disassembly, Proceedings of the 10th ACM conference on Computer and communication security , CCS '03, 2003. ,
DOI : 10.1145/948109.948149
Pin: Building Customized Program Analysis Tools with Dynamic Instrumentation, PLDI. 2005 (cit, p.145 ,
Towards Revealing Attackers' Intent by Automatically Decrypting Network Traffic, 2008. ,
Shadow attacks: automatically evading system-call-behavior based malware detection, Journal in Computer Virology, vol.4, issue.1, pp.1-13, 2012. ,
DOI : 10.1007/s11416-011-0157-5
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.230.3444
Anti analysis tricks in Trojan-Downloader.Win32.Agent.abti url: http://www.martinsecurity.net/anti-analysis-tricks-in- trojan-downloaderwin32agentabti (cit, p.15, 2008. ,
System V Application Binary Interface, p.78, 2013. ,
url: http://www.mcafee.com/ us/resources/reports/rp-quarterly-threat-q2-2014.pdf (cit, p.18, 2014. ,
Skype Reverse. 2012. url: http : / / www . oklabs . net / category / skype-reverse ,
Petri nets are monoids, Information and Computation, vol.88, issue.2, pp.105-155, 1990. ,
DOI : 10.1016/0890-5401(90)90013-8
Neutralize Advanced Threats ,
A theory of type polymorphism in programming, Journal of Computer and System Sciences, vol.17, issue.3, 1978. ,
DOI : 10.1016/0022-0000(78)90014-4
Communicating and mobile systems: the ?-calculus, pp.59-151, 1999. ,
Bigraphical reactive systems: basic theory, p.128 ,
The Space and Motion of Communicating Agents, 2009. ,
DOI : 10.1017/CBO9780511626661
Limits of Static Analysis for Malware Detection, Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007), 2007. ,
DOI : 10.1109/ACSAC.2007.21
Exploring Multiple Execution Paths for Malware Analysis, 2007 IEEE Symposium on Security and Privacy (SP '07), pp.100-102, 2007. ,
DOI : 10.1109/SP.2007.17
Computer virus-antivirus coevolution, Communications of the ACM, vol.40, issue.1, pp.46-51, 1997. ,
DOI : 10.1145/242857.242869
A General Method Applicable to the Search for Similarities in the Amino Acid Sequence of Two Proteins, Journal of Molecular Biology, vol.483, pp.443-453, 1970. ,
Dynamic Binary Analysis and Instrumentation, 2004. ,
Valgrind: A Framework for Heavyweight Dynamic Binary Instrumentation, 2007. ,
Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software, In: NDSS, 2005. ,
Ultimate Packer for eXecutables, 2013. ,
Sophail: A Critical Analysis of Sophos Antivirus url: https, 2011. ,
url: http://mediacenter. pandasecurity.com/mediacenter/wp-content/uploads, 2014. ,
A Categorical Treatment of Malicious Behavioral Obfuscation ,
DOI : 10.1007/978-3-319-06089-7_20
Linear and branching structures in the semantics and logics of reactive systems, p.37, 1985. ,
DOI : 10.1007/BFb0015727
Multi-stage delivery of malware, 2010 5th International Conference on Malicious and Unwanted Software ,
DOI : 10.1109/MALWARE.2010.5665788
There???s Plenty of Room at the Bottom: Analyzing and Verifying Machine Code, 2010. ,
DOI : 10.1007/978-3-642-14295-6_6
Duqu -The precursor to the next Stuxnet url: http://www.symantec.com/content/en/us/enterprise/media/security_ response, 2011. ,
Stuxnet Dossier. Feb url: http://www.symantec. com/content, 2011. ,
Regin: Top-tier espionage tool enables stealthy surveillance ,
Classes of recursively enumerable sets and their decision problems, Transactions of the American Mathematical Society, vol.74, issue.2, pp.358-366, 1953. ,
DOI : 10.1090/S0002-9947-1953-0053041-6
Automatic analysis of malware behavior using machine learning, Journal of Computer Security, vol.19, issue.4, 2011. ,
DOI : 10.3233/JCS-2010-0410
Binary-code obfuscations in prevalent packer tools, ACM Computing Surveys, vol.46, issue.1, 2013. ,
DOI : 10.1145/2522968.2522972
PolyUnpack: Automating the Hidden-Code Extraction of Unpack-Executing Malware, 2006 22nd Annual Computer Security Applications Conference (ACSAC'06), p.14, 2006. ,
DOI : 10.1109/ACSAC.2006.38
Protecting Mobile Agents Against Malicious Hosts, 1998. ,
DOI : 10.1007/3-540-68671-1_4
On the Origins of Bisimulation and Coinduction, pp.38-54, 2009. ,
Nicene and Post-Nicene Fathers: Series I/Volume I/Confessions url: http : / / en . wikisource . org / wiki / Nicene _ and _ Post - Nicene_Fathers%3a_Series_I/Volume_I/Confessions, Book_XI, p.14, 2014. ,
All You Ever Wanted to Know About Dynamic Taint Analysis and Forward Symbolic Execution, SSP, 2010. ,
Disassembly of executable code revisited, Ninth Working Conference on Reverse Engineering, 2002. Proceedings., p.72, 2002. ,
DOI : 10.1109/WCRE.2002.1173063
A Survey of Graphical Languages for Monoidal Categories, pp.143-144, 2009. ,
DOI : 10.1007/978-3-642-12821-9_4
Impeding Malware Analysis Using Conditional Code Obfuscation, NDSS, 2008. ,
Anti-Debugging -A Developer's View, 2009. ,
Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software, p.2012 ,
The Sciences of the Artificial. 3rd, 1996. ,
Introduction to the Theory of Computation, ACM SIGACT News, vol.27, issue.1, 2005. ,
DOI : 10.1145/230514.571645
Dynamic program analysis of Microsoft Windows applications, 2010 IEEE International Symposium on Performance Analysis of Systems & Software (ISPASS), 2010. ,
DOI : 10.1109/ISPASS.2010.5452079
BitBlaze: A New Approach to Computer Security via Binary Analysis, 2008. ,
DOI : 10.1007/978-3-540-73368-3_52
Efficient Malware Detection Using Model-Checking ,
DOI : 10.1007/978-3-642-32759-9_34
Fuzzing: Brute Force Vulnerability Discovery, 2007. ,
The Art of Computer Virus Research and Defense, 2005. ,
Hunting For Metamorphic, 2001. ,
Trace Transformation Tool. 2013. url: http://goo.gl/rqCSQ (cit, p.145 ,
Mimicry attacks on host-based intrusion detection systems, Proceedings of the 9th ACM conference on Computer and communications security , CCS '02, pp.255-264, 2002. ,
DOI : 10.1145/586110.586145
Protection of Software-based Survivability Mechanisms, 2001. ,
ReFormat: Automatic Reverse Engineering of Encrypted Messages, ESORICS, vol.31, issue.23-24, 2009. ,
DOI : 10.1016/S1389-1286(99)00112-7
On Obfuscating Point Functions Automatic Network Protocol Analysis, STOC. 2005 (cit. on p. 5). [163], p.152, 2008. ,
Revealing Packed Malware, IEEE Security & Privacy Magazine, vol.6, issue.5, pp.65-69, 2008. ,
DOI : 10.1109/MSP.2008.126
Malicious Cryptography: Exposing Cryptovirology, p.152, 2004. ,
url: https://github.com/Visgean/Zeus.git (cit, p.119, 2014. ,