{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,25]],"date-time":"2026-01-25T12:51:20Z","timestamp":1769345480090,"version":"3.49.0"},"reference-count":49,"publisher":"Association for Computing Machinery (ACM)","issue":"5","license":[{"start":{"date-parts":[[2008,8,1]],"date-time":"2008-08-01T00:00:00Z","timestamp":1217548800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000144","name":"Division of Computer and Network Systems","doi-asserted-by":"publisher","award":["CNS-0448476CNS-0627501EIA-0080123CCR-0113633CNS-04I0918"],"award-info":[{"award-number":["CNS-0448476CNS-0627501EIA-0080123CCR-0113633CNS-04I0918"]}],"id":[{"id":"10.13039\/100000144","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CNS-0448476CNS-0627501EIA-0080123CCR-0113633CNS-04I0918"],"award-info":[{"award-number":["CNS-0448476CNS-0627501EIA-0080123CCR-0113633CNS-04I0918"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Program. Lang. Syst."],"published-print":{"date-parts":[[2008,8]]},"abstract":"<jats:p>\n            Malware detection is a crucial aspect of software security. Current malware detectors work by checking for\n            <jats:italic>signatures<\/jats:italic>\n            , which attempt to capture the syntactic characteristics of the machine-level byte sequence of the malware. This reliance on a syntactic approach makes current detectors vulnerable to code obfuscations, increasingly used by malware writers, that alter the syntactic properties of the malware byte sequence without significantly affecting their execution behavior.\n          <\/jats:p>\n          <jats:p>This paper takes the position that the key to malware identification lies in their semantics. It proposes a semantics-based framework for reasoning about malware detectors and proving properties such as soundness and completeness of these detectors. Our approach uses a trace semantics to characterize the behavior of malware as well as that of the program being checked for infection, and uses abstract interpretation to \u201chide\u201d irrelevant aspects of these behaviors. As a concrete application of our approach, we show that (1) standard signature matching detection schemes are generally sound but not complete, (2) the semantics-aware malware detector proposed by Christodorescu et al. is complete with respect to a number of common obfuscations used by malware writers and (3) the malware detection scheme proposed by Kinder et al. and based on standard model-checking techniques is sound in general and complete on some, but not all, obfuscations handled by the semantics-aware malware detector.<\/jats:p>","DOI":"10.1145\/1387673.1387674","type":"journal-article","created":{"date-parts":[[2008,9,4]],"date-time":"2008-09-04T12:51:35Z","timestamp":1220532695000},"page":"1-54","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":54,"title":["A semantics-based approach to malware detection"],"prefix":"10.1145","volume":"30","author":[{"given":"Mila Dalla","family":"Preda","sequence":"first","affiliation":[{"name":"University of Verona"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mihai","family":"Christodorescu","sequence":"additional","affiliation":[{"name":"University of Wisconsin, Madison"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Somesh","family":"Jha","sequence":"additional","affiliation":[{"name":"University of Wisconsin, Madison"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Saumya","family":"Debray","sequence":"additional","affiliation":[{"name":"University of Arizona, Tucson"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2008,9,4]]},"reference":[{"key":"e_1_2_1_1_1","series-title":"Lecture Notes in Computer Science","volume-title":"Proceedings of Advances in Cryptology (CRYPTO'88)","author":"Adleman L. M.","unstructured":"Adleman , L. M. 1988. An abstract theory of computer viruses . In Proceedings of Advances in Cryptology (CRYPTO'88) . Lecture Notes in Computer Science , vol. 403 . Springer , Berlin, Germany . Adleman, L. M. 1988. An abstract theory of computer viruses. In Proceedings of Advances in Cryptology (CRYPTO'88). Lecture Notes in Computer Science, vol. 403. Springer, Berlin, Germany."},{"key":"e_1_2_1_2_1","volume-title":"Proceedings of the Advances in Cryptology (CRYPTO'01)","volume":"2139","author":"Barak B.","unstructured":"Barak , B. , Goldreich , O. , Impagliazzo , R. , Rudich , S. , Sahai , A. , Vadhan , S. , and Yang , K . 2001. On the (im)possibility of obfuscating programs . In Proceedings of the Advances in Cryptology (CRYPTO'01) . Lecture Notes in Computer Science , vol. 2139 . Springer, 1--18. Barak, B., Goldreich, O., Impagliazzo, R., Rudich, S., Sahai, A., Vadhan, S., and Yang, K. 2001. On the (im)possibility of obfuscating programs. In Proceedings of the Advances in Cryptology (CRYPTO'01). Lecture Notes in Computer Science, vol. 2139. Springer, 1--18."},{"key":"e_1_2_1_3_1","volume-title":"Symposium on Requirements Engineering for Information Security. http:\/\/www.sreis.org\/old\/2001\/index.html.","author":"Bergeron J.","unstructured":"Bergeron , J. , Debbabi , M. , Desharnais , J. , Erhioui , M. M. , Lavoie , Y. , and Tawbi , N . 2001. Static detection of malicious code in executable programs . Symposium on Requirements Engineering for Information Security. http:\/\/www.sreis.org\/old\/2001\/index.html. Bergeron, J., Debbabi, M., Desharnais, J., Erhioui, M. M., Lavoie, Y., and Tawbi, N. 2001. Static detection of malicious code in executable programs. Symposium on Requirements Engineering for Information Security. http:\/\/www.sreis.org\/old\/2001\/index.html."},{"key":"e_1_2_1_4_1","unstructured":"Briesemeister L. Porras P. A. and Tiwari A. 2005. Model checking of worm quarantine and counter-quarantine under a group defense. Tech. rep. SRI-CSL-05-03 Computer Science Laboratory. SRI International.  Briesemeister L. Porras P. A. and Tiwari A. 2005. Model checking of worm quarantine and counter-quarantine under a group defense. Tech. rep. SRI-CSL-05-03 Computer Science Laboratory. SRI International."},{"key":"e_1_2_1_5_1","volume-title":"Proceedings of the Virus Bulletin Conference (VB2000)","author":"Chess D.","unstructured":"Chess , D. and White , S . 2000. An undetectable computer virus . In Proceedings of the Virus Bulletin Conference (VB2000) . Virus Bulletin, Orlando, FL. Chess, D. and White, S. 2000. An undetectable computer virus. In Proceedings of the Virus Bulletin Conference (VB2000). Virus Bulletin, Orlando, FL."},{"key":"e_1_2_1_6_1","volume-title":"Proceedings of the 4th International Information Security Conference (ISC'01)","volume":"2200","author":"Chow S.","unstructured":"Chow , S. , Gu , Y. , Johnson , H. , and Zakharov , V . 2001. An approach to the obfuscation of control-flow of sequential computer programs . In Proceedings of the 4th International Information Security Conference (ISC'01) , G. Davida and Y. Frankel, Eds. Lecture Notes in Computer Science , vol. 2200 . Springer, 144--155. Chow, S., Gu, Y., Johnson, H., and Zakharov, V. 2001. An approach to the obfuscation of control-flow of sequential computer programs. In Proceedings of the 4th International Information Security Conference (ISC'01), G. Davida and Y. Frankel, Eds. Lecture Notes in Computer Science, vol. 2200. Springer, 144--155."},{"key":"e_1_2_1_7_1","volume-title":"Proceedings of the 12th USENIX Security Symposium (Security'03)","author":"Christodorescu M.","unstructured":"Christodorescu , M. and Jha , S . 2003. Static analysis of executables to detect malicious patterns . In Proceedings of the 12th USENIX Security Symposium (Security'03) . USENIX Association, Berkeley, CA, 169--186. Christodorescu, M. and Jha, S. 2003. Static analysis of executables to detect malicious patterns. In Proceedings of the 12th USENIX Security Symposium (Security'03). USENIX Association, Berkeley, CA, 169--186."},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1287624.1287628"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.20"},{"key":"e_1_2_1_10_1","unstructured":"Christodorescu M. Kinder J. Jha S. Katzenbeisser S. and Veith H. 2005. Malware normalization. Tech. rep. 1539 University of Wisconsin Madison. WI.  Christodorescu M. Kinder J. Jha S. Katzenbeisser S. and Veith H. 2005. Malware normalization. Tech. rep. 1539 University of Wisconsin Madison. WI."},{"key":"e_1_2_1_11_1","unstructured":"Clarke  Jr. E. M. Grumberg O. and Peled D. A. 2001. Model Checking. MIT Press Cambridge MA.  Clarke Jr. E. M. Grumberg O. and Peled D. A. 2001. Model Checking. MIT Press Cambridge MA."},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1016\/0167-4048(89)90070-9"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1016\/0167-4048(87)90122-2"},{"key":"e_1_2_1_15_1","unstructured":"Collberg C. Thomborson C. and Low D. 1997. A taxonomy of obfuscating transformations. Tech. rep. 148 Department of Computer Sciences University of Auckland.  Collberg C. Thomborson C. and Low D. 1997. A taxonomy of obfuscating transformations. Tech. rep. 148 Department of Computer Sciences University of Auckland."},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/268946.268962"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/512950.512973"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/567752.567778"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1093\/logcom\/2.4.511"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/503272.503290"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/1190216.1190270"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/SEFM.2005.13"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1007\/11523468_107"},{"key":"e_1_2_1_24_1","unstructured":"Detristan T. Ulenspiegel T. Malcom Y. and von Underduk M. S. 2003. Polymorphic shellcode engine using spectrum analysis. Phrack 11 61 http:\/\/www.phrack.org.  Detristan T. Ulenspiegel T. Malcom Y. and von Underduk M. S. 2003. Polymorphic shellcode engine using spectrum analysis. Phrack 11 61 http:\/\/www.phrack.org."},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/SFCS.2005.60"},{"key":"e_1_2_1_26_1","volume-title":"Proceedings of the 6th International Symposium on Recent Advances in Intrusion Detection (RAID'03)","volume":"2820","author":"Gupta A.","unstructured":"Gupta , A. and Sekar , R . 2003. An approach for detecting self-propagating email using anomaly detection . In Proceedings of the 6th International Symposium on Recent Advances in Intrusion Detection (RAID'03) , G. Vigna, E. Jonsson, and C. Kruegel, Eds. Lecture Notes in Computer Science , vol. 2820 . Springer, 55--72. Gupta, A. and Sekar, R. 2003. An approach for detecting self-propagating email using anomaly detection. In Proceedings of the 6th International Symposium on Recent Advances in Intrusion Detection (RAID'03), G. Vigna, E. Jonsson, and C. Kruegel, Eds. Lecture Notes in Computer Science, vol. 2820. Springer, 55--72."},{"key":"e_1_2_1_27_1","volume-title":"IA-32 Intel Architecture Software Developer's Manual","author":"Intel Corporation","unstructured":"Intel Corporation . 2001. IA-32 Intel Architecture Software Developer's Manual . Intel Corporation . Intel Corporation. 2001. IA-32 Intel Architecture Software Developer's Manual. Intel Corporation."},{"key":"e_1_2_1_28_1","first-page":"4","article-title":"Dealing with metamorphism","volume":"10","author":"Jordan M.","year":"2002","unstructured":"Jordan , M. 2002 . Dealing with metamorphism . Virus Bull. 10 , 4 -- 6 . Jordan, M. 2002. Dealing with metamorphism. Virus Bull. 10, 4--6.","journal-title":"Virus Bull."},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1007\/11506881_11"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014105"},{"key":"e_1_2_1_31_1","volume-title":"Proceedings of the 11th Working Conference on Reverse Engineering (WCRE'04)","author":"Lakhotia A.","unstructured":"Lakhotia , A. and Mohammed , M . 2004. Imposing Order on Program Statements to Assist Anti-Virus Scanners . In Proceedings of the 11th Working Conference on Reverse Engineering (WCRE'04) . IEEE Computer Society, 161--170. Lakhotia, A. and Mohammed, M. 2004. Imposing Order on Program Statements to Assist Anti-Virus Scanners. In Proceedings of the 11th Working Conference on Reverse Engineering (WCRE'04). IEEE Computer Society, 161--170."},{"key":"e_1_2_1_32_1","unstructured":"Lakhotia A. and Singh P. K. 2000. Challenges in getting \u201cformal\u201d with viruses. In Virus Bull.  Lakhotia A. and Singh P. K. 2000. Challenges in getting \u201cformal\u201d with viruses. In Virus Bull."},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.5555\/645838.670721"},{"key":"e_1_2_1_34_1","volume-title":"Proceedings of the 7th USENIX Security Symposium. USENIX Association, 79--93","author":"Lee W.","unstructured":"Lee , W. and Stolfo , S . 1998. Data mining approaches for intrusion detection . In Proceedings of the 7th USENIX Security Symposium. USENIX Association, 79--93 . Lee, W. and Stolfo, S. 1998. Data mining approaches for intrusion detection. In Proceedings of the 7th USENIX Security Symposium. USENIX Association, 79--93."},{"key":"e_1_2_1_35_1","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy (S & P'99)","author":"Lee W.","unstructured":"Lee , W. , Stolfo , S. , and Mok , K. W . 1999. A data mining framework for building intrusion detection models . In Proceedings of the IEEE Symposium on Security and Privacy (S & P'99) . IEEE Computer Society, Los Alamitos, CA, USA, 120--132. Lee, W., Stolfo, S., and Mok, K. W. 1999. A data mining framework for building intrusion detection models. In Proceedings of the IEEE Symposium on Security and Privacy (S & P'99). IEEE Computer Society, Los Alamitos, CA, USA, 120--132."},{"key":"e_1_2_1_36_1","volume-title":"Proceedings of the 6th Annual IEEE Systems, Man, and Cybernetics (SMC) Workshop on Information Assurance (IAW'05)","author":"Li W.-J.","unstructured":"Li , W.-J. , Wang , K. , Stolfo , S. J. , and Herzog , B . 2005. Fileprints: Identifying file types by n-gram analysis . In Proceedings of the 6th Annual IEEE Systems, Man, and Cybernetics (SMC) Workshop on Information Assurance (IAW'05) . IEEE Computer Society, 64--71. Li, W.-J., Wang, K., Stolfo, S. J., and Herzog, B. 2005. Fileprints: Identifying file types by n-gram analysis. In Proceedings of the 6th Annual IEEE Systems, Man, and Cybernetics (SMC) Workshop on Information Assurance (IAW'05). IEEE Computer Society, 64--71."},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/948109.948149"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1016\/0167-4048(95)00012-W"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1007\/s102070100001"},{"key":"e_1_2_1_40_1","volume-title":"Proceedings of the Virus Bulletin Conference (VB2'001)","author":"Morley P.","year":"2001","unstructured":"Morley , P. 2001 . Processing virus collections . In Proceedings of the Virus Bulletin Conference (VB2'001) . Virus Bulletin, 129--134. Morley, P. 2001. Processing virus collections. In Proceedings of the Virus Bulletin Conference (VB2'001). Virus Bulletin, 129--134."},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/242857.242869"},{"key":"e_1_2_1_42_1","unstructured":"Rajaat. 1999. Polymorphism. 29A Mag. 1 3 1--2.  Rajaat. 1999. Polymorphism. 29A Mag. 1 3 1--2."},{"key":"e_1_2_1_43_1","volume-title":"Proceedings of the 4th IEEE Information Assurance Workshop. IEEE Computer Society","author":"Singh P.","unstructured":"Singh , P. and Lakhotia , A . 2003. Static verification of worm and virus behaviour in binary executables using model checking . In Proceedings of the 4th IEEE Information Assurance Workshop. IEEE Computer Society , Los Alamitos, CA, USA. Singh, P. and Lakhotia, A. 2003. Static verification of worm and virus behaviour in binary executables using model checking. In Proceedings of the 4th IEEE Information Assurance Workshop. IEEE Computer Society, Los Alamitos, CA, USA."},{"key":"e_1_2_1_44_1","volume-title":"Symantec Internet Security Threat Report: Trends for January 06--June 06","author":"Symantec Corporation","unstructured":"Symantec Corporation . 2006. Symantec Internet Security Threat Report: Trends for January 06--June 06 . Vol. X . Symantec Corporation , Cupertino, CA . Symantec Corporation. 2006. Symantec Internet Security Threat Report: Trends for January 06--June 06. Vol. X. Symantec Corporation, Cupertino, CA."},{"key":"e_1_2_1_45_1","volume-title":"The Art of Computer Virus Research and Defense","author":"Sz\u00f6r P.","unstructured":"Sz\u00f6r , P. 2005. The Art of Computer Virus Research and Defense . Addison-Wesley Professional , Boston, MA . Sz\u00f6r, P. 2005. The Art of Computer Virus Research and Defense. Addison-Wesley Professional, Boston, MA."},{"key":"e_1_2_1_46_1","volume-title":"Proceedings of the Virus Bulletin Conference (VB2001)","author":"Sz\u00f6r P.","unstructured":"Sz\u00f6r , P. and Ferrie , P . 2001. Hunting for metamorphic . In Proceedings of the Virus Bulletin Conference (VB2001) . Virus Bulletin, 123--144. Sz\u00f6r, P. and Ferrie, P. 2001. Hunting for metamorphic. In Proceedings of the Virus Bulletin Conference (VB2001). Virus Bulletin, 123--144."},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/SCAM.2006.20"},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/1060590.1060669"},{"key":"e_1_2_1_49_1","volume-title":"Automated reverse engineering: Mistfall engine. Published online at http:\/\/www.madchat.org\/\/vxdevl\/papers\/vxers\/Z0mbie\/autorev.txt (last accessed on","year":"2006","unstructured":"zombie. 2001a. Automated reverse engineering: Mistfall engine. Published online at http:\/\/www.madchat.org\/\/vxdevl\/papers\/vxers\/Z0mbie\/autorev.txt (last accessed on Sep. 29, 2006 ). zombie. 2001a. Automated reverse engineering: Mistfall engine. Published online at http:\/\/www.madchat.org\/\/vxdevl\/papers\/vxers\/Z0mbie\/autorev.txt (last accessed on Sep. 29, 2006)."},{"key":"e_1_2_1_50_1","unstructured":"zombie. 2001b. Real Permutating{sic} Engine. Published online at http:\/\/vx.netlux.org\/vx.php?id=er05.  zombie. 2001b. Real Permutating{sic} Engine. Published online at http:\/\/vx.netlux.org\/vx.php?id=er05."}],"container-title":["ACM Transactions on Programming Languages and Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1387673.1387674","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1387673.1387674","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T14:47:25Z","timestamp":1750258045000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1387673.1387674"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2008,8]]},"references-count":49,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2008,8]]}},"alternative-id":["10.1145\/1387673.1387674"],"URL":"https:\/\/doi.org\/10.1145\/1387673.1387674","relation":{},"ISSN":["0164-0925","1558-4593"],"issn-type":[{"value":"0164-0925","type":"print"},{"value":"1558-4593","type":"electronic"}],"subject":[],"published":{"date-parts":[[2008,8]]},"assertion":[{"value":"2007-07-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2007-10-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2008-09-04","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}