A Scheme of PE Virus Detection Using Fragile Software Watermarking Technique

Tian, Zuwei; Sun, Xingming; Yang, Hengfu

doi:10.4156/jdcta.vol5.issue2.18

JDCTA

2011

DOI: 10.4156/jdcta.vol5.issue2.18

|View full text |Cite

A Scheme of PE Virus Detection Using Fragile Software Watermarking Technique

Zuwei Tian¹,

Xingming Sun²,

Hengfu Yang³

Abstract: It is a difficult issue in the anti-virus field about how to detect unknown and packed PE (Portable Executable) viruses effectively, and existing schemes for anti-virus detection are dissatisfactory. Based on an analysis of the logical structures of Windows PE file and PE virus, a new method of PE virus detection is presented here, which exploits fragile software watermarking technique for virus detection. It describes how the new scheme embeds a software watermark into the PE files for virus detection. The ex… Show more

Help me understand this report

Search citation statements

Order By: Relevance

Paper Sections

Select...

Citation Types

Supporting

Mentioning

Contrasting

Year Published

2011

2014

Publication Types

Select...

Article5

Relationship

Self Cite1

Independent4

Authors

Journals

Cited by 5 publications

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

Generic Packing Detection Using Several Complexity Analysis for Accurate Malware Detection

Alanezi¹

2014

IJACSA

View full text Add to dashboard Cite

Abstract-The attackers do not want their Malicious software (or malwares) to be reviled by anti-virus analyzer. In order to conceal their malware, malware programmers are getting utilize the anti reverse engineering techniques and code changing techniques such as the packing, encoding and encryption techniques. Malware writers have learned that signature based detectors can be easily evaded by "packing" the malicious payload in layers of compression or encryption. State-of-the-art malware detectors have adopted both static and dynamic techniques to recover the payload of packed malware, but unfortunately such techniques are highly ineffective. If the malware is packed or encrypted, then it is very difficult to analyze. Therefore, to prevent the harmful effects of malware and to generate signatures for malware detection, the packed and encrypted executable codes must initially be unpacked. The first step of unpacking is to detect the packed executable files.The objective is to efficiently and accurately distinguish between packed and non-packed executables, so that only executables detected as packed will be sent to an general unpacker, thus saving a significant amount of processing time. The generic method of this paper show that it achieves very high detection accuracy of packed executables with a low average processing time.In this paper, a packed file detection technique based on complexity measured by several algorithms, and it has tested using a packed and unpacked dataset of file type .exe. The preliminary results are very promising where achieved high accuracy with enough performance. Where it achieved about 96% detection rate on packed files and 93% detection rate on unpacked files. The experiments also demonstrate that this generic technique can effectively prepared to detect unknown, obfuscated malware and cannot be evaded by known evade techniques.

show abstract

Generic Packing Detection Using Several Complexity Analysis for Accurate Malware Detection

Alanezi¹

2014

IJACSA

View full text Add to dashboard Cite

show abstract

Information Hiding Algorithm based on PE File Icon Resource

Tian¹,

Sun²,

Yang³

2011

JCIT

View full text Add to dashboard Cite

A Novel Watermark Embedding and Detection Scheme Based on Zero- Knowledge Proof

Fu¹,

Sun²,

Zhang³

et al. 2011

JDCTA

Self Cite

View full text Add to dashboard Cite

A new watermark embedding and detection method in Microsoft Word 2007-2010 files which use Office Open XML (OOXML) format is proposed in this paper. Watermark information can be imperceptibly embedded into OOXML documents by replacing or adding the values of Revision Identifiers (RIs), which are specific attributes in the main document body of the OOXML document. In the detection process, a secure watermark detection scheme based on zero-knowledge proof is proposed without revealing any watermarking-related information to improve the security of watermarking detection. Experiments show that 4.43 bit is embedded into each word and 0.07 bit is embedded into each bit of the document on average, which is higher than contemporary linguistic watermarking approaches. The method can resist "Format", "Impersonation", "Save As", "Copy" and other active attacks and all these changes will not be shown on the MS Office screen display. Therefore, the proposed method can apply to the field of security protection for OOXML format documents.

show abstract

scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.

Contact Info

customersupport@researchsolutions.com

10624 S. Eastern Ave., Ste. A-614

Henderson, NV 89052, USA

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Blog Terms and Conditions API Terms Privacy Policy Contact Cookie Preferences Do Not Sell or Share My Personal Information

Made with 💙 for researchers

Part of the Research Solutions Family.

A Scheme of PE Virus Detection Using Fragile Software Watermarking Technique

Cited by 5 publications

References 11 publications

Generic Packing Detection Using Several Complexity Analysis for Accurate Malware Detection

Generic Packing Detection Using Several Complexity Analysis for Accurate Malware Detection

Information Hiding Algorithm based on PE File Icon Resource

A Novel Watermark Embedding and Detection Scheme Based on Zero- Knowledge Proof

Contact Info

Product

Resources

About