Detect encrypted program based on CPU statistics

摘要

Techniques are presented for detecting malware in an executable. The method includes receiving an executable to evaluate for malware, emulating an execution of the executable up to a first count of instructions, determining a number of cache misses that occur while emulating the executable up to the first count of instructions, comparing the number of cache misses to a threshold, and upon determining the number of cache misses exceeds the threshold, identifying the executable as potentially containing malware.

主权项

1. A method for detecting malware in an executable, the method comprising:
receiving an executable to evaluate for malware; executing the executable up to a first count of instructions, determining a number of cache misses that occur while executing the executable up to the first count of instructions; comparing the number of cache misses to a threshold, wherein the threshold corresponds to an expected number of cache misses occurring when executing a program containing junk instructions; and upon determining the number of cache misses exceeds the threshold, identifying the executable as potentially containing malware based at least on the number of cache misses.