Shane R. Snyder
US Army CERDEC
Abderdeen Proving Grouds, MD
Detection of Metamorphic Malware Variants using Control and Data Flow Analysis
Abstract: Current malware detection and classification tools fail to adequately address variants that are generated automatically using new polymorphic and metamorphic transformation engines that can produce variants that bear no resemblance to one another. Existing solutions address this problem by employing syntactic signatures that mimic the underlying control structures such as call- and flow-graphs. These techniques, however, are easily defeated using new program diversification techniques. This hampers our ability to defend against zero day attacks perpetrated by such auto "replicating", rapidly spreading malware variants. In this talk, we present a new form of abstract malware signature generation that is based on extracting semantic summaries of malware code that is immune to most polymorphic and metamorphic transformations. We also present results of our initial, experimental evaluation of the proposed approach.
Biography: Shane R Snyder is a Computer Engineer at the US Army Communications-Electronics Research, Development, and Engineering Center, managing their tactical information assurance research programs. Mr. Snyder has 13 years of technical and managerial experience and has been working on protecting U.S. Army systems for his 13 year career. Specific areas of experience include Tactical Public Key Infrastructure (TPKI), Intrusion Detection Systems (IDS), Cryptographic Modernization, and Biometrics. Mr. Snyder holds a Bachelors degree in Electrical Engineer from Widener University and a Master degree in Electrical Engineering from Stevens Institute of Technology.