Christodorescu and Jha Receive Best Paper Award

Posted 16 July 2004
Mihai Christodorescu and Somesh Jha received the ACM SIGSOFT Distinguished Paper Award for their paper, Testing Malware Detectors, that appeared at the International Symposium on Software Testing and Analysis.

In today's interconnected world, malware, such as worms and viruses, can cause havoc. A malware detector (commonly known as virus scanner) attempts to identify malware. In spite of the importance of malware detectors, there is a dearth of testing techniques for evaluating them. We presented a technique based on program obfuscation for generating tests for malware detectors. Our technique is geared towards evaluating the resilience of malware detectors to various obfuscation transformations commonly used by hackers to disguise malware. We also demonstrated that a hacker can leverage a malware detector's weakness in handling obfuscation transformations and can extract the signature used by a detector for a specific malware. We evaluated three widely-used commercial virus scanners using our techniques and discovered that the resilience of these scanners to various obfuscations is very poor.

The paper is available online: [Abstract] [pdf] [ps]

<< Back to index

This page updated October 18, 2005.