Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to know the importance of Theoritical CS/Formal methods in Malware research. Due to the large volume of new malware variants received per day (~50,000 samples/day according to McAfee), malware researchers are heavily dependent on dynamic analysis (i.e. running the samples in a sandbox and monitoring their behavior) and moving away from static analysis and Reverse engineering as these approaches are very time consuming and sometimes becomes very challenging due to obfuscation/encryption.

I found a very useful talk (BlackHat 2010) by Greg Hoglund on Malware attribution where the speaker talks about the importance of bringing in the malware authors and their networks into the picture which gives valuable information than just analyzing the binary itself.

My question is:

If malware researchers move towards analyzing the behavior of malware authors and their network, in the future, does theoretical CS/formal methods has any importance in malware research.

Thank you.

share|improve this question
You need more context. Important to whom? In what capacity. Will hammers be obsoleted by the nail gun? For construction profesionals yes, for wood craftsmen no. – this.josh Aug 10 '12 at 4:01
@this.josh I've never heard that point stated so well. Mind if I steal that quote? ^_^ – Polynomial Aug 10 '12 at 5:50
@Polynomial theft-deterrent mechanism has been disengaged, steal away. – this.josh Aug 28 '12 at 6:49

What makes you think that formal methods or theoretical CS will be relevant?

I think a better question is: what tools from computer science might be relevant to this problem? My answer to that question would be: statistical machine learning methods may be highly relevant. (You could also look at stylometry -- author identification -- if you are interested in the attribution problem. However, that may be a challenging research problem.)

Generally speaking, formal methods and theoretical CS are not used much in malware research. On first impression, they do not seem very relevant to the malware problem. Today, most malware research happens in the systems community, which focuses on tools, applied work, methods for software analysis, and so on.

To learn more about current research, I recommend reading the research papers on the subject. You could look at the top conferences (e.g., Usenix Security, IEEE Security & Privacy, ACM CCS, NDSS) as well as conferences focused specifically on this problem (e.g., DIMVA, LEET, WOOT, etc.).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.