Authors:
Taegyu Kim
1
;
Woomin Hwang
1
;
Chulmin Kim
1
;
Dong-Jae Shin
1
;
Ki-Woong Park
2
and
Kyu Ho Park
1
Affiliations:
1
Korea Advanced Institute of Science and Technology (KAIST), Korea, Republic of
;
2
Daejeon University, Korea, Republic of
Keyword(s):
Malware Variant Classification, Identical Structured Control Flow, Table Division, Dynamic Resource Allocation, NUMA (Non Uniform Memory Access).
Related
Ontology
Subjects/Areas/Topics:
Communication and Software Technologies and Architectures
;
Computer-Supported Education
;
e-Business
;
Energy and Economy
;
Enterprise Information Systems
;
Information Technologies Supporting Learning
;
Mobile and Pervasive Computing
;
Security and Privacy
;
Sustainable Computing and Communications
;
Telecommunications
Abstract:
Control flow matching methods have been utilized to detect malware variants. However, as the number of malware variants has soared, it has become harder and harder to detect all malware variants while maintaining
high accuracy. Even though many researchers have proposed control flow matching methods, there is still a trade-off between accuracy and performance. To solve this trade-off, we designed Malfinder, a method
based on approximate matching, which is accurate but slow. To overcome its low performance, we resolve its performance bottleneck and non-parallelism on three fronts: I-Filter for identical string matching, table
division to exclude unnecessary comparisons with some malware and dynamic resource allocation for efficient parallelism. Our performance evaluation shows that the total performance improvement is 280.9 times.