Callgraph properties of executables

Issue title: Network Analysis in Natural Sciences and Engineering

Article type: Research Article

Authors: Bilar, Daniel

Affiliations: Wellesley College, Department of Computer Science, Wellesley, MA 02481, USA. E-mail: dbilar@wellesley.edu

Abstract: This paper examines the callgraphs of 120 malicious and 280 non-malicious executables. Pareto models are fitted to indegree, outdegree and basic block count distributions, and a statistically significant difference is shown for the derived power law exponent. A two-step optimization process is hypothesized to account for structural features of the executable.

Keywords: Executables, callgraph, graph-structural fingerprint, malware, optimization, HOT (highly optimized tolerance) process

Journal: AI Communications, vol. 20, no. 4, pp. 231-243, 2007