Signal Processing - March 2016 - 105

applications coRnER
Lakshmanan Nataraj
and B.S. Manjunath

SPAM: Signal Processing to Analyze Malware

yberattacks have risen in recent
times. The attack on Sony Pictures
by hackers, allegedly from North
Korea, received worldwide attention.
U.S. President Barack Obama issued a
statement and "vowed a U.S. response
after North Korea's alleged cyberattack"
[1]. This dangerous malware, termed
wiper, could overwrite data and stop
important execution processes. An analysis by the U.S. Federal Bureau of Investigation showed distinct similarities
between this attack and the code used to
attack South Korea in 2013, thus confirming that hackers reuse code from
already existing malware to create new
variants. This attack, along with other
recently discovered attacks such as Regin
and Opcleaver, give one clear message:
current cybersecurity defense mechanisms are not sufficient enough to thwart
these sophisticated attacks.
Today's defense mechanisms, such
as commercial antivirus (AV) software,
is based on scanning systems for suspicious or malicious activity. If such an
activity is found, the files under suspect
are either quarantined or the vulnerable
system is patched with an update. In turn,
the AV software is also updated with new
signatures to identify such activities in the
future. The scanning methods are based on
a variety of techniques such as static analysis-, dynamic analysis-, and other heuristics-based techniques, which are often
slow to react to new attacks and threats.
Static analysis is based on analyzing an executable without executing
Digital Object Identifier 10.1109/MSP.2015.2507185
Date of publication: 7 March 2016

it. These techniques include searching
for specific strings, computing cryptographic hashes, and disassembling the
executable to extract features. On the
other hand, dynamic analysis executes
the binary executable and studies its
behavioral characteristics in a virtual sandboxed environment. Some of
the methods include system-call-level
monitoring and memory snapshot comparison. Hackers are familiar with these
standard methods and come up with
ways to evade the current defense mechanisms. They produce new malware
variants that easily evade the detection
methods. These variants are created
from existing malware using inexpensive, easily available "factory tool kits"
in a virtual factory-like setting, which
then spread and infect more systems.
Once a system is compromised, it either
quickly loses control and/or the infection spreads to other networked systems.
While security techniques constantly evolve to keep up with new attacks,
hackers too change their ways and continue to evade defense mechanisms.
As this never-ending billion dollar "cat
and mouse game" continues, it may be
useful to look at avenues that can bring
in novel alternative and/or orthogonal defense approaches to counter the
ongoing threats. The hope is to catch
these new attacks using complementary
methods that may not be well known
to hackers, thus making it more difficult and/or too expensive for them to
evade all detection schemes. This article
focuses on such orthogonal approaches
from signal and image processing that
complement standard approaches.
IEEE Signal Processing Magazine

March 2016

Malware landscape
Malware-malicious software-is any
software that is designed to cause damage to a computer, server, network,
mobile phones, and other devices.
Based on their specific function such as
stealing data, spying, keylogging or
others, malware are classified into different types such as trojans, backdoors,
virus, worm, spyware, adware, and
more. Malware are also identified by
which platform they belong to, such as
Windows, Linux, AndroidOS, and others. While most malware are geared
toward the Windows platform, they are
also quickly expanding to other platforms such as AndroidOS, Linux, and
MAC OS X. Malware are further classified into families, which in turn, have
many variants that perform almost the
same function (Figure 1). According to
the Computer Antivirus Research
Organization (CARO) convention for
naming malware, a malware is represented by Type:Platform/Family.Variant. For example, PWS:Win32/Zbot.
gen denotes a password-stealer malware of the generic Zbot family that
attacks 32-bit Windows platforms.
Malware variants are created either
by making changes to the malware
code or by using executable packers.
In the former case, a simple mutation
occurs by changing small parts of the
code. These are referred to as unpacked
malware variants. In the latter case, a
more complex mutation occurs either
by compressing or encrypting (usually
with different keys) the main body of
the code and appending a decompression/decryption routine, which during
105

Table of Contents for the Digital Edition of Signal Processing - March 2016