BTMD: A Framework of Binary Translation Based Malcode Detector

Abstract

Binary Translation technology is used to convert binary code of one Instruction Set Architecture (ISA) into another. This technology can solve the software-inheritance problem and ISA-compatibility between different computers architecture. In this paper, we describe BTMD (Binary Translation based Malcode Detector), a novel framework that exploits static and dynamic binary translation features to detect broad spectrum malware and prevent its execution. By operating directly on binary code with MD Rules on the availability of source code, BTMD is appropriate for translating low-level binary code to high-level proper representation, obtaining CFG (Control Flow Graph) and other high-level Control Structure by MD Parser. Then Critical API Graph based on CFG is generated to do sub graph matching with the defined Malware Behavior Template. MD Engine in BTMD is called to undertake the process to take on the remaining code analysis. Compared with other detection approaches, BTMD is found to be very efficient in terms of detection capability and false alarm rate.