Formal Abstraction of Semantics for Detecting Malicious Code

Semantics-based malware detection is a considerable technique to find out the semantically equivalent malicious codes with different layout. This paper presents an abstraction of instructions from lower-level program form to an intermediate representation which describes the program semantics. This abstraction is depended on decompilation technology. We detect malicious code based on patterns, which are obtained by previous experience of malware analysis, and build on top of the abstraction above. At last, we evaluate our method informally, and the result shows that our method is more resilient to detect obfuscated malicious code transformed by several obfuscation policies.