Malware sometimes changes its behavior. [Research Saturday]

Published: Oct. 30, 2021, 7 a.m.

b'Dr. Tudor Dumitras from University of Maryland and\\xa0joins Dave Bittner to share a research study conducted in collaboration with industry partners from Facebook, NortonLifeLock Research Group and EURECOM. The project is called: "When Malware Changed Its Mind: An Empirical Study of Variable Program Behaviors in the Real World." In the study, the team analyzed how malware samples change their behavior when executed on different hosts or at different times. Such \\u201csplit personalities\\u201d may confound the current techniques for malware analysis and detection. Malware execution traces are typically collected by executing the samples in a controlled environment (a \\u201csandbox\\u201d), and the techniques created and tested using such traces do not account for the broad range of behaviors observed in the wild. In the paper, the team shows how behavior variability can make those techniques appear more effective than they really are, and they make some recommendations for dealing with the variability.\\nThe research and executive summary can be found here:\\n\\nWhen Malware Changed Its Mind: An Empirical Study of Variable Program Behaviors in the Real World\\n\\nAnalysing malware variability in the real world'