Quantifying obfuscation stealth und resilience for malware research and analysis
In this talk, research work will be presented towards an expert system for deciding on the most suitable analysis methods and tools
On Monday 5th of December we welcome Dr. Sebastian Schrittwieser for a talk at Reykjavik University, room V105 at 14:00.
Abstract: Code obfuscation, i.e. the artificial complication of program code, is used by almost every malware with the aim of preventing detection and analysis of its internal workings. While there are many program analysis methodologies and tools available, their ability to deal with particular code obfuscation techniques varies widely. Therefore, it is essential for both manual and automated malware analysis to be able to reliably identify which obfuscation technique a previously unknown malware uses and which analysis technique or tool is best suited for further analysis.
In this talk, research work will be presented towards an expert system for deciding on the most suitable analysis methods and tools. Based on a large-scale evaluation of stealth und resilience properties of obfuscations and combinations thereof against different code analysis methods and existing tools as well as an in-depth analysis of past literature, we aim at building a detailed knowlege base on malware obfuscation for more targeted analysis and de-obfuscation.
Bio: Dr.Sebastian Schrittwieser is a researcher and teacher in the research group on security and privacy at the University of Vienna, Austria. His main research interests are in software protection and on threat modelling. In particular, he works on quantitative prediction models for estimating the strength of code obfuscation and on the inference of cyber defense strategies through reinforced threat modelling.
