Hands-On Artificial Intelligence for Cybersecurity

How to perform static analysis

Once you have verified that the disassembled malware is reliable, it is possible to proceed in different ways: each analyst, in fact, follows their own preferred strategy, which is based on the experience and objectives they intend to pursue.

In principle, the adoptable strategies are as follows:

• Analyze the binary instructions in a systematic way, without executing them. It is an effective technique for limited portions of code that become complicated in cases of large malware, as the analyst must a keep trace of the status of the data for each instruction analyzed.
• Scan the instructions to look for sequences that are considered to be of interest, setting breakpoints and partially executing the program up ...