A framework for defining malware behavior using run time analysis and resource monitoring

Abstract

Malware analysis is the process to investigate malware operation in order to learn and understand that malicious intent. Two common techniques that can be used to analyze malware are static analysis and dynamic analysis. Nowadays, many malware writers try to avoid security checking by implement techniques such as anti-reverse engineering, packing and encryption. It was make static analysis difficult to be implemented. In this paper, we propose a new framework to analyze malware by using dynamic approach. This framework will define malware behavior through run time analysis and resource monitoring. The contribution of this study is the new framework for defining malware behavior based on operation and target operation of the malware. © 2011 Springer-Verlag.