Malware network behavior extraction based on dynamic binary analysis

Malware is a tremendous threat on the Internet. Current malware analysis systems focus on listing the malware behaviors, but make no mention of malware network behaviors which results in malware's self-duplication and self-propagation on the Internet. In this paper, we present a new method to extract malware network behaviors. Our method is based on dynamic binary analysis and dynamic taint analysis. With the dynamic binary analysis, we can extract the malware network behavior and the self-duplication behavior. We also present a method to catch malware self-propagation behavior by using dynamic taint analysis. Finally, we evaluate our method and the results show that our method is successful in extracting malware network behavior and identifying the malware self-duplication behavior.