...
首页> 外文期刊>Procedia Computer Science >Identification of library functions statically linked to Linux malware without symbols
【24h】

Identification of library functions statically linked to Linux malware without symbols

机译:识别库函数与Linux恶意软件无符号的Linux函数

获取原文
   

获取外文期刊封面封底 >>

       

摘要

Many Linux malware have been found to have statically linked library functions. Much of this malware are stripped of function names and addresses, hindering function-level analysis. For function-level analysis, we identified library functions stically linked to 2,256 malware samples with the Intel 80386 architecture by matching patterns. The pattern matching identified more than 90% of the library functions for 97.7% of the samples. Thus, pattern matching can be effective for library identification. Only 12 toolchains had been used to build 99.8% of samples, and 11 of the toolchains are available on the Internet. The C library used by the malware was uClibc in 96.5% of the samples, musl in 1.3% and GLIBC in 2.0%.
机译:已发现许多Linux恶意软件具有静态链接的库函数。这些恶意软件的大部分都被剥离了功能名称和地址,妨碍了功能级分析。对于功能级别分析,我们通过匹配模式将库函数与英特尔80386架构一起定时链接到2,256个恶意软件样本。模式匹配识别出97.7%的图书馆函数的90%以上。因此,模式匹配可以有效地对图书馆识别。仅使用12个工具箱来构建99.8%的样本,互联网上有11个刀鞘。恶意软件使用的C库是uClibc,96.5%的样品中,Musl为1.3%,Glibc为2.0%。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱:kefu@zhangqiaokeyan.com

京公网安备:11010802029741号 ICP备案号:京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有
  • 客服微信

  • 服务号