A visualization technique for installation evidences containing malicious executable files using machine language sequence

Abstract

In the modern society the majority of information is stored and preserved on the digitalized storage medium. By the way, it is difficult to recognize that there are any adding, deleting, or changing of the records in the digitalized storage medium. In this paper, we suggest an evidence detection technique of malicious executable file installation on computer system using visualization of similarity between machine language sequences. Also suggested method can not only detect original malwares but also mutants of them. Besides, our method can help to reassemble the data blocks containing the fragments of the malicious file back into their proper sequences for securing legal evidences. © 2009 Springer Berlin Heidelberg.