2015/03/04 by Diane Duros Hosfelt, Hosfelt, Diane Duros
Computer Science · #Advanced Malware Detection Techniques #Cryptographic Implementations and Security #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Network Security and Intrusion Detection #cs.CR
paper · pdf · doi:10.48550/arxiv.1503.01186
Thesis submitted in partial fulfillment of MSE CS degree at Johns Hopkins University, 25 pages
arxiv created 2015/03/04 · openalex publication_date 2015/03/04 · arxiv updated 2015/03/05 · openalex created_date 2016/06/24 · openalex updated_date 2026/07/28
Threats from the internet, particularly malicious software (i.e., malware) often use cryptographic algorithms to disguise their actions and even to take control of a victim's system (as in the case of ransomware). Malware and other threats proliferate too quickly for the time-consuming traditional methods of binary analysis to be effective. By automating detection and classification of cryptographic algorithms, we can speed program analysis and more efficiently combat malware. This thesis will present several methods of leveraging machine learning to automatically discover and classify cryptographic algorithms in compiled binary programs. While further work is necessary to fully evaluate these methods on real-world binary programs, the results in this paper suggest that machine learning can be used successfully to detect and identify cryptographic primitives in compiled code. Currently, these techniques successfully detect and classify cryptographic algorithms in small single-purpose programs, and further work is proposed to apply them to real-world examples.