[TYPES/announce] Fully funded Postdoctoral position at Inria Rennes - Bretagne Atlantique on Malware Analysis

[Fabrizio Biondi]

Dear colleagues,

  We have opened a fully-funded Postdoc position at Inria Rennes (France).
I would be very grateful if you could distribute it to potentially
interested Ph. D. students and parties. I also apologize in advance for the
potential cross-posting.

Thank you,

Fabrizio

------------

The TAMIS team (https://team.inria.fr/tamis) at Inria Rennes - Bretagne
Atlantique is looking for a talented Postdoctoral researcher to work on
malware analysis.

The candidate will develop new techniques and tools for the extraction of
representative semantic signatures from obfuscated malware binaries. The
candidate will improve and implement deobfuscation techniques to
efficiently extract semantic signatures from malware, in the context of a
new experimental approach for malware analysis and collaborating with
national and international teams from both academia and industry.

Malware analysis aims to understand the behavior of malware binaries to be
able to detect and reverse infection. Since each malware has a wide range
of variants, classification of a given binary as a variant of known malware
is an important step to neutralizing malware[1,2,3].

The objective of the project is to develop a tool that executes malware
binaries in a realistic virtualized environment able to defeat
counter-virtualization techniques while simulating a large number of
architectures. This tool should execute the malware concretely and
symbolically as necessary and fingerprint its behavior. The fingerprint
will be compared against a database of known malware fingerprints to
classify the analyzed malware binary.

However, malware compilation chains implement obfuscation mechanisms and
cryptographically-enhanced control flow flattening to hinder the analysts'
efforts to classify malware and understand their behavior [4]. Obfuscation
interferes with any attempt to reconstruct the malware's infective behavior
and its control flow, and consequently precludes malware classification.

We have recently shown [5] how Reed-Muller expansion synthesis algorithms
[6,7,8] can be employed as a generalized technique to simplify and
deobfuscate functions and conditionals by considering them as black-box
oracles and reconstructing their input-output behavior by interrogating
them. Synthesis allows us to defeat various direct code obfuscation
techniques. In particular, when combined with our concrete and symbolic
execution approach it allows us to simplify complex or obfuscated parts of
the code and obtain a clear view of the malware's behavior.

The ideal candidate for this position will have a Ph. D. in computer
science or a related discipline, strong work ethic, ability to work
independently as well as an effective team member, experience in developing
efficient software tools and an interest in information security. Expertise
in reverse engineering, symbolic/concolic execution and malware analysis
will be considered positively for the selection process.

The TAMIS team is the largest security-oriented team at Inria, with
competence spanning the whole field of security, from hardware to protocols
and industry standards.

Candidates are invited to send their application to fabrizio.biondi at inria.fr
and axel.legay at inria.fr . Please include a CV, a short motivation letter
and contact information for 2 referees.

Best regards,

Fabrizio

[1] J.O. Kephart and W.C. Arnold: "Automatic Extraction of Computer Virus
Signatures". Proc. Int'l Conf. Fourth Virus Bull., pp. 178-184, 1994.

[2] S. Cesare and Y. Xiang: "Classification of Malware Using Structured
Control Flow". Proc. Eighth Australasian Symp. Parallel and Distributed
Computing (AusPDC '10), 2010.

[3] S. Cesare and Y. Xiang, Wanlei Zhou: "Control Flow-Based Malware
Variant Detection". IEEE Trans. Dependable Sec. Comput. 11(4): 307-317
(2014)

[4] C. Wang: "A Security Architecture for survivability Mechanisms". Phd
thesis, Department of Computer Science, University of Virginia (October
2000)

[5] F. Biondi, S. Josse, and A. Legay: "Comparative Evaluation of the
Effectiveness of Constraint Solvers against Opaque Conditionals". Proc.
IEEE S&P (poster session), 2015.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.seas.upenn.edu/pipermail/types-announce/attachments/20161002/56cbaa19/attachment-0001.html>