A retrovirus inspired algorithm for virus detection &amp; optimization

Edge, Kenneth S.; Lamont, Gary B.; Raines, Richard A.

doi:10.1145/1143997.1144016

Cited by 22 publications

(9 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The signature generator uses signatures which are defined as the string patterns which are unique to identify and characterize the malware. In another work proposed by Edge et al [15], an artificial immune system genetic algorithm (REALGO) was developed based on the human immune system's use of reverse transcription ribonucleic acid (RNA). The REALGO algorithm combines known information from past viruses with a type of prediction for future viruses.…”

Section: Evolutionary Approaches For Pattern Generationmentioning

confidence: 99%

On the use of artificial malicious patterns for android malware detection

Jerbi

Dagdia

Bechikh

et al. 2020

Computers & Security

View full text Add to dashboard Cite

Malware programs currently represent the most serious threat to computer information systems. Despite the performed efforts of researchers in this field, detection tools still have limitations for one main reason. Actually, malware developers usually use obfuscation techniques consisting in a set of transformations that make the code and/or its execution difficult to analyze by hindering both manual and automated inspections. These techniques allow the malware to escape the detection tools, and hence to be seen as a benign program. To solve the obfuscation issue, many researchers have proposed to extract frequent Application Programming Interface (API) call sequences from previously encountered malware programs using pattern mining techniques and hence, build a base of fraudulent behaviors. Based on this process, it is worth mentioning that the performance of the detection process heavily depends on the base of examples of malware behaviors; also called malware patterns. In order to deal with this shortcoming, a dynamic detection method called Artificial Malware-based Detection (AMD) is proposed in this paper. AMD makes use of not only extracted malware patterns but also artificially generated ones. The artificial malware patterns are generated using an evolutionary (genetic) algorithm. The latter evolves a population of API call sequences with the aim to find new malware behaviors following a set of well-defined evolution rules. The artificial fraudulent behaviors are subsequently inserted into the base of examples in order to enrich it with unseen malware patterns. The main motivation behind the proposed AMD approach is to diversify the base of malware examples in order to maximize the detection rate. AMD has been tested on different Android malware data sets and compared against recent prominent works using commonly employed performance metrics. The performance analysis of the obtained results shows the merits of our AMD novel approach.

show abstract

Section: Evolutionary Approaches For Pattern Generationmentioning

confidence: 99%

On the use of artificial malicious patterns for android malware detection

Jerbi

Dagdia

Bechikh

et al. 2020

Computers & Security

View full text Add to dashboard Cite

show abstract

“…Forrest et al first proposed an NSA to detect abnormal modification on protected data [1] and later applied it to UNIX process detection [8]. Since then, more and more researchers have devoted themselves to the study of computer immune systems based on immune mechanisms and many immune based computer malware detection models have been proposed [9][10][11][12][13].…”

Section: Related Workmentioning

confidence: 99%

A malware detection model based on a negative selection algorithm with penalty factor

Zhang

Wang

Tan

2010

Sci. China Inf. Sci.

View full text Add to dashboard Cite

A malware detection model based on a negative selection algorithm with penalty factor (NSAPF) is proposed in this paper. This model extracts a malware instruction library (MIL), containing instructions that tend to appear in malware, through deep instruction analysis with respect to instruction frequency and file frequency. From the MIL, the proposed model creates a malware candidate signature library (MCSL) and a benign program malware-like signature library (BPMSL) by splitting programs orderly into various short bit strings. Depending on whether a signature matches "self", the NSAPF further divides the MCSL into two malware detection signature libraries (MDSL1 and MDSL2), and uses these as a two-dimensional reference for detecting suspicious programs. The model classifies suspicious programs as malware and benign programs by matching values of the suspicious programs with MDSL1 and MDSL2. Introduction of a penalty factor C in the negative selection algorithm enables this model to overcome the drawback of traditional negative selection algorithms in defining the harmfulness of "self" and "nonself", and focus on the harmfulness of the code, thus greatly improving the effectiveness of the model and also enabling the model to satisfy the different requirements of users in terms of true positive and false positive rates. Experimental results confirm that the proposed model achieves a better true positive rate on completely unknown malware and a better generalization ability while keeping a low false positive rate. The model can balance and adjust the true positive and false positive rates by adjusting the penalty factor C to achieve better performance. CitationZhang P T, Wang W, Tan Y. A malware detection model based on a negative selection algorithm with penalty factor.

show abstract

“…In addition, we pursue a multiobjective approach because the consolidation of information into a single aggregated objective tends to lose data granularity and offer the decisionmaker only one solution vice a set of trade-off solutions. The solution approach develops a new proof-of-concept algorithm that advances the existing work of two AIS-motivated algorithms: Edge, Lamont and Raines' retrovirus algorithm (REALGO) [6] for its ability to escape local optima, with regard to string matching, and Coello and Cortés' multiobjective immune system algorithm (MISA) [5] for its employment of an AIS in a multiobjective EA context.…”

Section: Hypothesismentioning

confidence: 99%

“…The C-to-Java migration experiment is straightforward, yet we are concerned about the impact of a different programming language and random number generator on the output. Figure 6 compares the output between REALGO and jREALGO, employing REALGO's Yao and Liu's test function [6]where the optimal value is -12569.5. Figure 7 compares the output between MISA and jMISA, employing MISA's Kita-proposed two-variable test function [5].…”

Section: Experimentation and Analysismentioning

confidence: 99%

An Artificial Immune System-Inspired Multiobjective Evolutionary Algorithm with Application to the Detection of Distributed Computer Network Intrusions

Haag

Lamont

Williams

et al. 2007

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Today's signature-based intrusion detection systems are reactive in nature and storage-limited. Their operation depends upon catching an instance of an intrusion or virus and encoding it into a signature that is stored in its anomaly database, providing a window of vulnerability to computer systems during this time. Further, the maximum size of an Internet Protocol-based message requires the database to be huge in order to maintain possible signature combinations. In order to tighten this response cycle within storage constraints, this paper presents an innovative Artificial Immune System-inspired Multiobjective Evolutionary Algorithm. This distributed intrusion detection system (IDS) is intended to measure the vector of tradeoff solutions among detectors with regard to two independent objectives: best classification fitness and optimal hypervolume size. Our antibody detectors promiscuously monitor network traffic for exact and variant abnormal system events based on only the detector's own data structure and the application domain truth set, responding heuristically. Applied to the MIT-DARPA 1999 insider intrusion detection data set, our software engineered algorithm correctly classifies normal and abnormal events at a high level which is directly attributed to a detector affinity threshold.

show abstract

A retrovirus inspired algorithm for virus detection & optimization

Cited by 22 publications

References 17 publications

On the use of artificial malicious patterns for android malware detection

On the use of artificial malicious patterns for android malware detection

A malware detection model based on a negative selection algorithm with penalty factor

An Artificial Immune System-Inspired Multiobjective Evolutionary Algorithm with Application to the Detection of Distributed Computer Network Intrusions

Contact Info

Product

Resources

About