{"repo":"csvl/SEMA","free":true,"listed":false,"github":"https://github.com/csvl/SEMA","clone":"git clone https://github.com/csvl/SEMA.git","description":"SEMA is based on angr, a symbolic execution engine used to extract API calls. Especially, we extend ANGR with strategies to create representative signatures based on System Call Dependency graph (SCDG). Those SCDGs can be exploited in machine learning modules to do classification/detection.","language":"Python","stars":122,"topics":["malware-analysis","malware","symbolic","classification","symbolic-execution","detection","angr","ctf","concolic-execution","linux"],"license":"BSD-2-Clause","category":"security-tools","readme_excerpt":":skull and crossbones: SEMA :skull and crossbones: ToolChain using Symbolic Execution for Malware Analysis. Toolchain architecture Our toolchain is represented in the following figure and works as follows: - A collection of labelled binaries from different malware families is collected and used as the input of the toolchain. - Angr , a framework for symbolic execution, is used to execute binaries symbolically and extract execution traces. For this purpose, different heuristics have been developed to optimize symbolic execution. - Several execution traces (i.e., API calls used and their arguments) corresponding to one binary are extracted with Angr and gathered together using several graph heuristics to construct a SCDG. - These resulting SCDGs are then used as input to graph mining to extract common graphs between SCDGs of the same family and create a signature. - Finally, when a new sample has to be classified, its SCDG is built and compared with SCDGs of known families using a simple similarity metric. This repository contains a first version of a SCDG extractor. During the symbolic analysis of a binary, all system calls and their arguments found are recorded. After some stop conditions for symbolic analysis, a graph is built as follows: Nodes are system calls recorded, edges show that some arguments are shared between calls. When a new sample has to be evaluated, its SCDG is first built as described previously. Then, gspan is applied to extract the biggest common subgraph ","default_branch":null,"files":null,"tree":[],"storefront":"/r/csvl","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/csvl/SEMA/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}