Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to know, in malware analysis, what is meant by "multi-path execution". I read this when I encounter the words in malware detection literature related to Control Flow Graph (CFG).

share|improve this question
add comment

2 Answers

I looked it up, so i'm no expert, but it seems to mean this.

When code is conditional, for instance by using an 'if' statement, a CPU must decide which 'branch' (the if or the else) to take. However, in modern CPUs, instructions are pre-fetched and some calculations are made on instructions not yet executed, so branching poses a problem: which branch should be evaluated? Multipath execution (http://csd.ijs.si/courses/processor/chapter4/sld072.htm) means evaluating both branches, and discarding the branch that eventually turns out not to be the taken path.

In relation to CFG: when taking multiple branches, multiple edges will be temporarily travelled. However, after the condition has been fully evaluated, only one edge will remain, the others will be discarded.

Have a look at http://en.wikipedia.org/wiki/Branch_predictor for a lot of info on how a modern CPU can deal with branching.

This seems to me as not being a typical 'malware' issue, but a general debugging concept.

Someone correct me if I'm talking nonsense :-)

share|improve this answer
    
thanks! yes, that cleared things up :) –  talfiq Jan 5 '13 at 3:51
add comment

I believe the phrase is in reference to determining if a given piece of code is or is not malware. Standard application code has statistical properties regarding barnching during execution. Analyzing a piece of code and comparing its branching behavior to standard models is one test you can use to detect malware. If the branching behavior is similar to the model the test would indicate that this is not maleware. If the branching behavior is significantly different from the model the test would indicate the the code is maleware. Of course tests like these may produce incorrect results. A piece of maleware evaluate as normal code, which is a false negative. Or a piece of normal code may evaluate as maleware, which is a false positive. Since maleware is not as data or user input dependent as most application code, some types of maleware tend to have highly linear (non-branching) execution patterns. Of course a sophisticated maleware designer could hide this by including a lot more branching.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.