Thesis on Behavioral Analysis of Malware

Status: Completed

The thesis describes what constitutes a malware behavior and exploits their inherent hierarchical nature to group seemingly infinite number of behaviors into intent based hierarchical components. These intents are then sub-divided based on the implementation strategy adopted by the malware author. Each of these implementations is composed from a small set of “objects” and “actions”. By means of a controlled experiment, we verified the notion that a relatively small set of “objects” and “actions” can be used to compose a very large number of behaviors. The thesis also brought out an interesting idea of examining component-communication to cripple malware.