I would like to know, in malware analysis, what is meant by "multi-path execution". I read this when I encounter the words in malware detection literature related to Control Flow Graph (CFG).
I looked it up, so i'm no expert, but it seems to mean this.
When code is conditional, for instance by using an 'if' statement, a CPU must decide which 'branch' (the if or the else) to take. However, in modern CPUs, instructions are pre-fetched and some calculations are made on instructions not yet executed, so branching poses a problem: which branch should be evaluated? Multipath execution (http://csd.ijs.si/courses/processor/chapter4/sld072.htm) means evaluating both branches, and discarding the branch that eventually turns out not to be the taken path.
In relation to CFG: when taking multiple branches, multiple edges will be temporarily travelled. However, after the condition has been fully evaluated, only one edge will remain, the others will be discarded.
Have a look at http://en.wikipedia.org/wiki/Branch_predictor for a lot of info on how a modern CPU can deal with branching.
This seems to me as not being a typical 'malware' issue, but a general debugging concept.
Someone correct me if I'm talking nonsense :-)
I believe the phrase is in reference to determining if a given piece of code is or is not malware. Standard application code has statistical properties regarding barnching during execution. Analyzing a piece of code and comparing its branching behavior to standard models is one test you can use to detect malware. If the branching behavior is similar to the model the test would indicate that this is not maleware. If the branching behavior is significantly different from the model the test would indicate the the code is maleware. Of course tests like these may produce incorrect results. A piece of maleware evaluate as normal code, which is a false negative. Or a piece of normal code may evaluate as maleware, which is a false positive. Since maleware is not as data or user input dependent as most application code, some types of maleware tend to have highly linear (non-branching) execution patterns. Of course a sophisticated maleware designer could hide this by including a lot more branching.