Mark Stamp

In this research, we compare malware detection techniques based on static, dynamic, and hybrid analysis. Specifically, we train Hidden Markov Models (HMMs ) on both static and dynamic feature sets and compare the resulting detection rates over a substantial number of malware families. We also consider hybrid cases, where dynamic analysis is used in the training phase, with static techniques used in the detection phase, and vice versa. In our experiments, a fully dynamic approach generally yields the best detection rates. We discuss the implications of this research for malware detection based on hybrid techniques.

In this paper, we explore the effectiveness of dynamic analysis techniques for identifying malware, using Hidden Markov Models (HMMs) and Profile Hidden Markov Models (PHMMs), both trained on sequences of API calls. We contrast our results to static analysis using HMMs trained on sequences of opcodes, and show that dynamic analysis achieves significantly stronger results in many cases. Furthermore, in contrasting our two dynamic analysis techniques, we find that using PHMMs consistently outperforms our analysis based on HMMs.

In this article, we consider the problem of detecting software that has been pirated and modified. We analyze a variety of detection techniques that have been previously studied in the context of malware detection. For each technique, we empirically determine the detection rate as a function of the degree of modification of the original code. We show that the code must by substantially modified before we fail to reliably distinguish it, and we show that our results offer a significant improvement over previous related work. Our approach can be applied retroactively to existing software and does not require access to the source code, and hence it is both practical and effective.

Rotor cipher machines played a large role in World War II: Germany used Enigma; America created Sigaba; Britain developed Typex. The breaking of Enigma by Polish and (later) British cryptanalysts had an enormous impact on the war. However, despite being based on the commercial version of the Enigma, there is no documented successful attack on Typex during its time in service. This article covers the Typex machine. Researchers consider the development of Typex, discuss how Typex works, and present and analyze two cryptanalytic attacks on the cipher. The first attack assumes the rotor wirings are known and uses Turing's crib attack—originally developed for Enigma—to recover the settings of the stepping rotors. The second attack assumes that the rotor wirings are unknown. This ciphertext-only attack uses a hill-climb to determine the wirings of the stepping rotors. Finally, researchers briefly consider an attack developed by Polish cryptanalysts to recover the Enigma rotor wirings, and they argue that Typex was significantly more resistant to this particular attack.