Semantics-Aware Malware Detection

The goal of this proposal is to advance the state-of-the-art in malware detectors, and thereby offer protection against next-generation malicious code. Currently, malware detectors - in the form of commercial virus scanners - are an important component in the defense of computer systems. We propose to build on a technique that has demonstrated its ability to detect malware in the presence of common obfuscations, and to outperform existing commercial malware detectors. A key goal of this proposal is to address shortcomings of existing malware detectors by (a) being able to recognize obfuscated malware, and (b) providing the ability to preemptively scan for malicious code before it is ever observed in the wild, thereby preventing damage from a day-zero attack.