Matches in SemOpenAlex for { <https://semopenalex.org/work/W2049208027> ?p ?o ?g. }
Showing items 1 to 93 of
93
with 100 items per page.
- W2049208027 abstract "Analyzing cryptographic implementations has important applications, especially for malware analysis where they are an integral part both of the malware payload and the unpacking code that decrypts this payload. These implementations are often based on well-known cryptographic functions, whose description is publicly available. While potentially very useful for malware analysis, the identification of such cryptographic primitives is made difficult by the fact that they are usually obfuscated. Current state-of-the-art identification tools are ineffective due to the absence of easily identifiable static features in obfuscated code. However, these implementations still maintain the input-output (I/O) relationship of the original function. In this paper, we present a tool that leverages this fact to identify cryptographic functions in obfuscated programs, by retrieving their I/O parameters in an implementation-independent fashion, and comparing them with those of known cryptographic functions. In experimental evaluation, we successfully identified the cryptographic functions TEA, RC4, AES and MD5 both in synthetic examples protected by a commercial-grade packer (AsProtect), and in several obfuscated malware samples (Sality, Waledac, Storm Worm and SilentBanker). In addition, our tool was able to recognize basic operations done in asymmetric ciphers such as RSA." @default.
- W2049208027 created "2016-06-24" @default.
- W2049208027 creator A5002841791 @default.
- W2049208027 creator A5054567629 @default.
- W2049208027 creator A5067704386 @default.
- W2049208027 date "2012-10-16" @default.
- W2049208027 modified "2023-10-14" @default.
- W2049208027 title "Aligot" @default.
- W2049208027 cites W126407768 @default.
- W2049208027 cites W1572300106 @default.
- W2049208027 cites W2002821154 @default.
- W2049208027 cites W2004814164 @default.
- W2049208027 cites W2109394932 @default.
- W2049208027 cites W2132271754 @default.
- W2049208027 cites W2134633067 @default.
- W2049208027 cites W2136331433 @default.
- W2049208027 cites W2156453323 @default.
- W2049208027 cites W2175377689 @default.
- W2049208027 cites W4232836212 @default.
- W2049208027 doi "https://doi.org/10.1145/2382196.2382217" @default.
- W2049208027 hasPublicationYear "2012" @default.
- W2049208027 type Work @default.
- W2049208027 sameAs 2049208027 @default.
- W2049208027 citedByCount "54" @default.
- W2049208027 countsByYear W20492080272012 @default.
- W2049208027 countsByYear W20492080272013 @default.
- W2049208027 countsByYear W20492080272014 @default.
- W2049208027 countsByYear W20492080272015 @default.
- W2049208027 countsByYear W20492080272016 @default.
- W2049208027 countsByYear W20492080272017 @default.
- W2049208027 countsByYear W20492080272018 @default.
- W2049208027 countsByYear W20492080272019 @default.
- W2049208027 countsByYear W20492080272020 @default.
- W2049208027 countsByYear W20492080272021 @default.
- W2049208027 countsByYear W20492080272022 @default.
- W2049208027 countsByYear W20492080272023 @default.
- W2049208027 crossrefType "proceedings-article" @default.
- W2049208027 hasAuthorship W2049208027A5002841791 @default.
- W2049208027 hasAuthorship W2049208027A5054567629 @default.
- W2049208027 hasAuthorship W2049208027A5067704386 @default.
- W2049208027 hasBestOaLocation W20492080272 @default.
- W2049208027 hasConcept C116834253 @default.
- W2049208027 hasConcept C134066672 @default.
- W2049208027 hasConcept C158379750 @default.
- W2049208027 hasConcept C15927051 @default.
- W2049208027 hasConcept C177264268 @default.
- W2049208027 hasConcept C178489894 @default.
- W2049208027 hasConcept C199360897 @default.
- W2049208027 hasConcept C26713055 @default.
- W2049208027 hasConcept C2776760102 @default.
- W2049208027 hasConcept C33884865 @default.
- W2049208027 hasConcept C38652104 @default.
- W2049208027 hasConcept C41008148 @default.
- W2049208027 hasConcept C541664917 @default.
- W2049208027 hasConcept C59822182 @default.
- W2049208027 hasConcept C80444323 @default.
- W2049208027 hasConcept C84525096 @default.
- W2049208027 hasConcept C86803240 @default.
- W2049208027 hasConceptScore W2049208027C116834253 @default.
- W2049208027 hasConceptScore W2049208027C134066672 @default.
- W2049208027 hasConceptScore W2049208027C158379750 @default.
- W2049208027 hasConceptScore W2049208027C15927051 @default.
- W2049208027 hasConceptScore W2049208027C177264268 @default.
- W2049208027 hasConceptScore W2049208027C178489894 @default.
- W2049208027 hasConceptScore W2049208027C199360897 @default.
- W2049208027 hasConceptScore W2049208027C26713055 @default.
- W2049208027 hasConceptScore W2049208027C2776760102 @default.
- W2049208027 hasConceptScore W2049208027C33884865 @default.
- W2049208027 hasConceptScore W2049208027C38652104 @default.
- W2049208027 hasConceptScore W2049208027C41008148 @default.
- W2049208027 hasConceptScore W2049208027C541664917 @default.
- W2049208027 hasConceptScore W2049208027C59822182 @default.
- W2049208027 hasConceptScore W2049208027C80444323 @default.
- W2049208027 hasConceptScore W2049208027C84525096 @default.
- W2049208027 hasConceptScore W2049208027C86803240 @default.
- W2049208027 hasLocation W20492080271 @default.
- W2049208027 hasLocation W20492080272 @default.
- W2049208027 hasOpenAccess W2049208027 @default.
- W2049208027 hasPrimaryLocation W20492080271 @default.
- W2049208027 hasRelatedWork W1539179632 @default.
- W2049208027 hasRelatedWork W2096921767 @default.
- W2049208027 hasRelatedWork W2149659470 @default.
- W2049208027 hasRelatedWork W2153810551 @default.
- W2049208027 hasRelatedWork W2160606508 @default.
- W2049208027 hasRelatedWork W2167921885 @default.
- W2049208027 hasRelatedWork W4231491598 @default.
- W2049208027 hasRelatedWork W4285413924 @default.
- W2049208027 hasRelatedWork W4304208154 @default.
- W2049208027 hasRelatedWork W2565846362 @default.
- W2049208027 isParatext "false" @default.
- W2049208027 isRetracted "false" @default.
- W2049208027 magId "2049208027" @default.
- W2049208027 workType "article" @default.