• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Information visualization >Reversing compiled executables for malware analysis via visualization
【24h】

Reversing compiled executables for malware analysis via visualization

机译：通过可视化反转已编译的可执行文件以进行恶意软件分析

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Reverse engineering-compiled executables is a task with a steep learning curve. It is complicated by the task of translating assembly into a series of abstractions that represent the overall flow of a program. Most of the steps involve finding interesting areas of an executable and determining their general functionality. This article presents a method using dynamic analysis of program execution to visually represent the general flow of a program. We use the Ether hypervisor framework to covertly monitor a program. The data are processed and presented for the reverse engineer. The VERA (Visualization of Executables for Reversing and Analysis) system specifically accelerates the location of the original entry point and understanding of overall executable functionality. Using this method, the amount of time needed to extract key features of an executable is greatly reduced, improving productivity. Two malware samples are used to demonstrate the advantages of using the VERA system to reverse engineer malware. Further, these examples exemplify a reversing process enhanced through effective use of dynamic analysis tools. Preliminary user study indicates that the tool is useful for both new and experienced users.
机译：逆向工程编译的可执行文件是一项具有陡峭学习曲线的任务。将程序集转换为代表程序总体流程的一系列抽象的任务使该过程变得复杂。大多数步骤涉及查找可执行文件的有趣区域并确定其常规功能。本文介绍了一种使用动态分析程序执行来直观地表示程序总体流程的方法。我们使用Ether虚拟机管理程序框架秘密监视程序。数据被处理并提供给逆向工程师。 VERA（用于反转和分析的可执行文件的可视化）系统专门加快了原始入口点的位置，并加速了整体可执行功能的理解。使用此方法，可以大大减少提取可执行文件关键功能所需的时间，从而提高了生产率。使用两个恶意软件样本来演示使用VERA系统对恶意软件进行反向工程的优势。此外，这些示例举例说明了通过有效使用动态分析工具而增强的逆向过程。初步的用户研究表明，该工具对新用户和有经验的用户都有用。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号