AWE: improving software analysis through modular integration of static and dynamic analyses

ABSTRACT

AWE is a prototype system for performing analysis of x86 executables in the absence of source code or debugging information. It provides a modular infrastructure for integrating static and dynamic analyses into a single workflow. One of the major challenges with performing analysis of modern software is the amount of data that must be analyzed by a human to determine software behavior. This challenge is further compounded by the number of different tools and extensive expertise required to perform such analyses. The AWE system addresses this challenge in two ways: first by focusing analyst's attention on a prioritized subset of software features of importance, and second by simplifying analysis through an integrated static and dynamic analysis workflo.

REFERENCES

• 1: G. Balakrishnan, R. Gruian, T. Reps, and T. Teitelbaum. CodeSurfer/x86--A platform for analyzing x86 executables. In Proc. Int. Conf. on Compiler Construction, April 2005.
• 2: DataRescue. The IDA Pro disassembler and debugger. http://www.datarescue.com
• 3: GrammaTech. CodeSurfer. http://www.grammatech.com
• 4: O. Yuschuk. OllyDbg. http://www.ollydbg.de
• 5: Ed Skoudis , Lenny Zeltser, Malware: Fighting Malicious Code, Prentice Hall PTR, Upper Saddle River, NJ, 2005
• 6: Arun Lakhotia , Eric Uday Kumar, Abstracting Stack to Detect Obfuscated Calls in Binaries, Proceedings of the Source Code Analysis and Manipulation, Fourth IEEE International Workshop on (SCAM'04), p.17-26, September 15-16, 2004 [doi>10.1109/SCAM.2004.1]
• 7: M. Venable, M. R. Chouchane, M. E. Karim and A. Lakhotia. Analyzing memory accesses in obfuscated x86 executables. In Lecture Notes in Computer Science, volume 3548, pp 1--18, 2005.
• 8: Jesse C. Rabek , Roger I. Khazan , Scott M. Lewandowski , Robert K. Cunningham, Detection of injected, dynamically generated, and obfuscated malicious code, Proceedings of the 2003 ACM workshop on Rapid malcode, October 27-27, 2003, Washington, DC, USA [doi>10.1145/948187.948201]
• 9: J. Bergeron , Mourad Debbabi , M. M. Erhioui , Béchir Ktari, Static Analysis of Binary Code to Isolate Malicious Behaviors, Proceedings of the 8th Workshop on Enabling Technologies on Infrastructure for Collaborative Enterprises, p.184-189, June 16-18, 1999
• 10: M. Ernst. Static and dynamic analysis: synergy and duality. In Workshop on Dynamic Analysis (WODA), 2003.

INDEX TERMS

Primary Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.4 Software/Program Verification
          Subjects: Formal methods

Additional Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.4 Software/Program Verification
          Subjects: Validation
      D.2.7 Distribution, Maintenance, and Enhancement
          Subjects: Restructuring, reverse engineering, and reengineering

General Terms:
Algorithms, Security, Verification

Keywords:
dynamic analysis, malicious software analysis, static analysis