Malware Detection

Brian Witten, Carey Nachenberg (auth.), Mihai Christodorescu, Somesh Jha, Douglas Maughan, Dawn Song, Cliff Wang (eds.)0-387-32720-7, 978-0-387-32720-4, 0-387-44599-4, 978-0-387-44599-1

Many malicious attacks are achieved by malicious code or malware, such as viruses and worms. Shared resources, such as the Internet, have created a highly interconnected cyber-infrastructure. Critical infrastructures in domains such as medical, power, telecommunications, and finance are highly dependent on information systems. These two factors have exposed our critical infrastructures to malicious attacks and accidental failures. Given the deleterious affects of malware on our cyber infrastructure, identifying malicious programs is an important goal. Unfortunately, malware detectors have not kept pace with the evasion techniques commonly used by hackers–the good guys are falling behind in the arms race.

Malware Detection, based on the Special ARO/DHS Workshop on Malware Detection at Rosslyn, VA, in 2005, captures the state of the art research in the area of malicious code detection, prevention and mitigation.

This edited volume is intended for researchers and developers working on malicious code (malware) detection, prevention and mitigation. In addition it can be used for a senior level undergraduate course, or for a graduate course in the area of computer and software security.

Table of contents :
Front Matter….Pages I-XI
Front Matter….Pages 1-1
Malware Evolution: A Snapshot of Threats and Countermeasures in 2005….Pages 3-15
Front Matter….Pages 17-17
Static Disassembly and Code Analysis….Pages 19-41
A Next-Generation Platform for Analyzing Executables….Pages 43-61
Behavioral and Structural Properties of Malicious Code….Pages 63-83
Detection and Prevention of SQL Injection Attacks….Pages 85-109
Front Matter….Pages 111-111
Very Fast Containment of Scanning Worms, Revisited….Pages 113-145
Sting: An End-to-End Self-Healing System for Defending against Internet Worms….Pages 147-170
An Inside Look at Botnets….Pages 171-191
Can Cooperative Intrusion Detectors Challenge the Base-Rate Fallacy?….Pages 193-209
Front Matter….Pages 211-211
Composite Hybrid Techniques For Defending Against Targeted Attacks….Pages 213-229
Towards Stealthy Malware Detection….Pages 231-249
Front Matter….Pages 251-251
Pioneer: Verifying Code Integrity and Enforcing Untampered Code Execution on Legacy Systems….Pages 253-289
Principles of Secure Information Flow Analysis….Pages 291-307
Back Matter….Pages 309-312