恶意程序的实证网络结构
Empirical Network Structure of Malicious Programs
AI总结：
本文通过实证分析恶意二进制文件中数据依赖图与控制流图的网络结构，揭示其无标度、小世界及度相关性等特性，为提高程序分类特征分辨率和语义映射提供定量基础。
摘要：
现代二进制可执行文件是多种网络的组合。在用于分类任务的标注数据集中，控制流图（Control Flow Graph）通常被用来表示可执行程序。控制流和项表示被广泛采用，但只提供了程序语义的部分视图。本研究是对构成恶意二进制文件的网络进行的实证分析，旨在提供程序结构属性的完整表示。这是通过在恶意二进制可执行文件数据集中测量程序网络的结构属性来实现的。我们证明了程序数据依赖图和控制流图的网络结构存在无标度（Scale-Free）属性，并表明数据依赖图还具有小世界（Small-World）结构属性。我们表明，程序数据依赖图具有结构上异配（disassortative）的度相关性，而控制流图具有中性的度同配性（degree assortativity），这表明使用随机图来建模程序控制流图的结构属性将显示出更高的准确性。通过提高可执行程序标注数据集中的特征分辨率，我们为解释在控制流图图特征上训练的分类器的结果提供了定量基础。特征分辨率的提高使得程序类别的结构属性及其组成部分能够被分析以发现模式。通过捕获程序图的完整图景，我们可以为将程序的操作语义映射到其结构的理论解决方案提供可能。
英文摘要：
A modern binary executable is a composition of various networks. Control flow graphs are commonly used to represent an executable program in labeled datasets used for classification tasks. Control flow and term representations are widely adopted, but provide only a partial view of program semantics. This study is an empirical analysis of the networks composing malicious binaries in order to provide a complete representation of the structural properties of a program. This is accomplished by the measurement of structural properties of program networks in a malicious binary executable dataset. We demonstrate the presence of Scale-Free properties of network structure for program data dependency and control flow graphs, and show that data dependency graphs also have Small-World structural properties. We show that program data dependency graphs have a degree correlation that is structurally disassortative, and that control flow graphs have a neutral degree assortativity, indicating the use of random graphs to model the structural properties of program control flow graphs would show increased accuracy. By providing an increase in feature resolution within labeled datasets of executable programs we provide a quantitative basis to interpret the results of classifiers trained on CFG graph features. An increase in feature resolution allows for the structural properties of program classes to be analyzed for patterns as well as their component parts. By capturing a complete picture of program graphs we can enable theoretical solutions for the mapping a program's operational semantics to its structure.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
