The International Conference on Information Networking 2014 (ICOIN2014) (2013)
Jan. 28, 2013 to Jan. 30, 2013
Peidai Xie , Sch. of Cornputer, Nat. Univ. of Defense Technol., Changsha, China
Xicheng Lu , Sch. of Cornputer, Nat. Univ. of Defense Technol., Changsha, China
Jinshu Su , Sch. of Cornputer, Nat. Univ. of Defense Technol., Changsha, China
Yongjun Wang , Sch. of Cornputer, Nat. Univ. of Defense Technol., Changsha, China
Meijian Li , Sch. of Cornputer, Nat. Univ. of Defense Technol., Changsha, China
Malware analysis is the process of dissecting a given malware sample in order to determine its purpose and functionality. It is a necessary step to develop effective detection techniques of malicious code and removal tools. The public malware analysis systems are major sources for a user to understand a malware sample. However analysis reports of those analysis systems only include what operation system resources created or accessed by the submitted malware sample, which is insufficient for a malware analyst, who expects a comprehensive analysis report. In this paper, we present iPanda, an analysts oriented comprehensive malware analysis tool. Several prevalent static and dynamic malware analysis techniques, such as detection of evading analysis techniques used by malware authors, information flow tracking, functional code fragments identifying, network behavior analysis, etc., are implemented complementarily in iPanda so that it allows a comprehensive analysis of malware to generate an analysis report including structure profile and behavior profile of the samples. The results are paramount valuable for malware analysts to perform malware detection and containment.
Malware, Monitoring, Entropy, Feature extraction, Protocols, Cryptography, Encoding
Peidai Xie, Xicheng Lu, Jinshu Su, Yongjun Wang and Meijian Li, "iPanda: A comprehensive malware analysis tool," 2013 International Conference on Information Networking (ICOIN), Bangkok, 2013, pp. 481-486.