Malware detection and classification are becoming more and more challenging, given the
complexity of malware design and the recent advancement of communication and …

Binary rewriting is changing the semantics of a program without having the source code at
hand. It is used for diverse purposes, such as emulation (eg, QEMU), optimization (eg …

Malicious code is an increasingly important problem that threatens the security of computer
systems. The traditional line of defense against malware is composed of malware detectors …

A great deal of software is distributed in the form of executable code. The ability to reverse
engineer such executables can create opportunities for theft of intellectual property via …

This thesis addresses the challenges of building a software system for general-purpose
runtime code manipulation. Modern applications, with dynamically-loaded modules and …

Malware attacks necessitate extensive forensic analysis efforts that are manual-labor
intensive because of the analysis-resistance techniques that malware authors employ. The …

Disassembly is the process of recovering a symbolic representation of a program's machine
code instructions from its binary representation. Recently, a number of techniques have …

Impact analysis, determining when a change in one part of a program affects other parts of
the program, is time-consuming and problematic. Impact analysis is rarely used to predict …

Buffer overflow attack is the most common and arguably the most dangerous attack method
used in Internet security breach incidents reported in the public literature. Various solutions …

Computer worms—malicious, self-propagating programs—represent a significant threat to
large networks. One possible defense, containment, seeks to limit a worm's spread by …