SEMA is based on angr, a symbolic execution engine used to extract API calls. Especially, we extend ANGR with strategies to create representative signatures based on System Call Dependency graph (SCDG). Those SCDGs can be exploited in machine learning modules to do classification/detection.
python windows linux detection static-analysis reverse-engineering malware symbolic-execution symbolic cybersecurity classification reverse ctf malware-analysis binary-analysis malware-research angr concolic-execution malware-detection sema
-
Updated
Nov 26, 2024 - Python