Spo2 t19 spo2-t19

This document summarizes an expert talk on advanced malware detection techniques. It discusses how malware exploits constraints on analysis time and memory space to evade detection. Current detection methods are outlined along with ways malware bypass them, such as packing, obfuscation, and anti-analysis techniques. The talk then presents novel detection techniques such as detecting internal data structure modifications, subverting malware attempts to enumerate security processes, tapping browsers to detect obfuscated drive-by downloads, and preemptively subverting analysis machines to detect anti-VM techniques. Future directions discussed include using machine learning to detect internal threats based on behavioral profiles.