Grant: Department of National Defence / NSERC Research Partnership

The current project pertains to the domain of software reverse engineering with applications to malwareanalysis. The project goals are the development of new malware analysis techniques, with their associatedtheoretical foundations, algorithms and tools to be run in a realistic reverse engineering environment so that themalware reverse engineering process be accelerated. The current research privileges a static approach whichcould yield better results and more interesting insights into the malware code compared to a dynamic approach.Automating the identification of code fragments which have been reused from previously analyzed assemblycode, which potentially reuse existing open source code, as well as featuring the origins and authorship ofmalware assembly code, are some of the concrete expected results from this research. The research works willfocus on reducing the search space to automatically match assembly code with source code at a low falsepositive rate. Given that each assembly code fragment may present a variant whilst maintaining the samefunctionality, a system for searching assembly code clones by using novel data mining techniques on indexedand analyzed assembly code will be designed. It will be heavily tested and characterized in terms of complexitydetection, accuracy, efficiency and scalability. As to identifying the creator of an assembly code, noveltechniques will be certainly proposed and tested in real case scenarios, since the source code level authorshiptechniques are unsuitable (the compiler will have removed most of the features shaping a programmer's style).Overall, the project results represent different facets of a single goal - ensuring a systematic and structuralknowledge of the malware assembly code and thus considerably lighten the burden of any reverse engineer.