DEVELOPMENT OF A MULTIDIMENSIONAL FACETED TAXONOMY OF MALWARE OBFUSCATION TECHNIQUES

Abstract

The article addresses the problem of systematisation of malware obfuscation techniques, which is complicated by the structural limitations of existing classification schemes in the field and the absence of an integrated approach to describing classical obfuscation techniques and anti-analysis techniques. In this work, obfuscation is understood in a broad sense, encompassing both classical obfuscation techniques and anti-analysis techniques, united by the common purpose of concealing the malicious behaviour of a program from analytical tools. Classical and modern obfuscation taxonomies are analysed, among which common systemic limitations are identified, including the inability to describe multi-aspect techniques by several independent characteristics simultaneously, the absence of an integrated approach to classical obfuscation techniques and anti-analysis techniques, and the construction of existing schemes without the application of a formal taxonomy development method. The goal of the work is to develop a multidimensional faceted taxonomy of malware obfuscation techniques that eliminates the identified limitations. To achieve this goal, the taxonomy development method of Nickerson, Varshney and Muntermann is applied with alternation of empirical-to-conceptual and conceptual-to-empirical iterations. As a result, a faceted taxonomy with five independent dimensions has been formed, namely the level of observability, the scope of impact, the mechanism of transformation, the phase of effect manifestation, and the behavioural invariance. The proposed taxonomy is applied to 16 representative obfuscation techniques of contemporary malware. The behavioural invariance dimension is proposed separately; it operationally distinguishes classical obfuscation techniques from anti-analysis techniques and ensures the integration of these two directions of concealment techniques into a common classification framework while preserving the structural distinction between them. The proposed taxonomy provides a methodological basis for the systematisation of obfuscation techniques and the design of detection systems for obfuscated malware.