Prepoznavanje programskih modula u izvršnim datotekama

master's thesis

• Title (english): Identifying Software Modules in Executable Files
• Author: Žad Deljkić
• Mentor: Predrag Pale (mentor)
• Committee member: Predrag Pale (predsjednik povjerenstva)
• Committee member: Zvonko Kostanjčar (član povjerenstva)
• Committee member: Dražen Jurišić (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2017-07-10, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Ovaj rad opisuje dizajn sustava neovisnog o platformi koji omogućuje automatsku detekciju zloćudnih programa, ponovne uporabe dijelova programskog koda, statički povezanog koda treće strane te ranjivih funkcija u izvršnom kodu.
Jezgra sustava je algoritam za generiranje potpisa funkcija koji obuhvaća funkcionalnost te je otporan na nefunkcionalne promjene.
Sustav je implementiran za Common Language Infrastructure platformu te evaluiran kao sustav za prepoznavanje poznatih funkcija te sustav za detekciju malicioznih programa.
Rezultati evaluacije pokazuju da sustav ima potencijala za korištenje u rješavanju problema u stvarnome svijetu.

Abstract (english)

This thesis describes a platform-independent system designed to be capable of automated detection of malicious programs, re-used parts of code, statically linked third party code and vulnerable functions in executable code.
The core of the system is an algorithm for generating function signatures that captures functionality, while being resistant to non-functional changes.
The system was implemented for the Common Language Infrastructure platform, and evaluated as a library function recognition system and a malware detection system.
The evaluation results show that the system has potential to be used in solving real-world problems.

• Keywords: potpisi funkcija; prepoznavanje poznatih funkcija; detekcija zloćudnih programa
• Keywords (english): function signatures; library function recognition; malware detection
• Language: english
• URN:NBN: urn:nbn:hr:168:042877
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2019-03-13 19:55:42