2

I would like to know the importance of Theoritical CS/Formal methods in Malware research. Due to the large volume of new malware variants received per day (~50,000 samples/day according to McAfee), malware researchers are heavily dependent on dynamic analysis (i.e. running the samples in a sandbox and monitoring their behavior) and moving away from static analysis and Reverse engineering as these approaches are very time consuming and sometimes becomes very challenging due to obfuscation/encryption.

I found a very useful talk (BlackHat 2010) by Greg Hoglund on Malware attribution where the speaker talks about the importance of bringing in the malware authors and their networks into the picture which gives valuable information than just analyzing the binary itself.

My question is:

If malware researchers move towards analyzing the behavior of malware authors and their network, in the future, does theoretical CS/formal methods has any importance in malware research.

Thank you.

Improve this question
3
  • 1
    You need more context. Important to whom? In what capacity. Will hammers be obsoleted by the nail gun? For construction profesionals yes, for wood craftsmen no.
    – this.josh
    Commented Aug 10, 2012 at 4:01
  • @this.josh I've never heard that point stated so well. Mind if I steal that quote? ^_^
    – Polynomial
    Commented Aug 10, 2012 at 5:50
  • @Polynomial theft-deterrent mechanism has been disengaged, steal away.
    – this.josh
    Commented Aug 28, 2012 at 6:49

1 Answer 1

Reset to default
3

What makes you think that formal methods or theoretical CS will be relevant?

I think a better question is: what tools from computer science might be relevant to this problem? My answer to that question would be: statistical machine learning methods may be highly relevant. (You could also look at stylometry -- author identification -- if you are interested in the attribution problem. However, that may be a challenging research problem.)

Generally speaking, formal methods and theoretical CS are not used much in malware research. On first impression, they do not seem very relevant to the malware problem. Today, most malware research happens in the systems community, which focuses on tools, applied work, methods for software analysis, and so on.

To learn more about current research, I recommend reading the research papers on the subject. You could look at the top conferences (e.g., Usenix Security, IEEE Security & Privacy, ACM CCS, NDSS) as well as conferences focused specifically on this problem (e.g., DIMVA, LEET, WOOT, etc.).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .