SEMA is based on angr, a symbolic execution engine used to extract API calls. Especially, we extend ANGR with strategies to create representative signatures based on System Call Dependency graph (SCDG). Those SCDGs can be exploited in machine learning modules to do classification/detection.
python
windows
linux
detection
static-analysis
reverse-engineering
malware
symbolic-execution
symbolic
cybersecurity
classification
reverse
ctf
malware-analysis
binary-analysis
malware-research
angr
concolic-execution
malware-detection
sema
-
Updated
Aug 19, 2024 - Python