A Review: Malware Analysis Work at IIT Kanpur

Abstract

The number of newly discovered malware is growing exponentially and pose big threats to the digital world. Users are now more frequent to use the Internet while banking or shopping online. These involve currency transactions and attract malware authors to attack servers and client machines. These hosts hold sensitive information such as personal data, browsing history, shopping history, financial details and much more. A conventional anti-malware software expects malicious programs to contain fixed and known structures. Whereas advanced malware like metamorphic malware is capable of obfuscating their internal structures after each infection. In this chapter, we discuss methods for the detection of such advanced malware using various machine learning techniques which detect/classify malware from static, dynamic and memory forensic features. In Sect. 5.1, we describe our tool PeerClear that is designed to detect peer-to-peer botnet. In Sect. 5.2, we describe malware classification tool we designed that works on features extracted from initial stages of their execution. In Sect. 5.3, we describe memory forensics-based malware detection technique we recently developed.