Detection of Spyware by Mining Executable Files

Abstract

Abstract--Spyware represents a serious threat to confidentiality since it may result in loss of control over private data for computer users. This type of software might collect the data and send it to a third party without informed user consent. Traditionally two approaches have been presented for the purpose of spyware detection: Signature-based Detection and Heuristic-based Detection. These approaches perform well against known Spyware but have not been proven to be successful at detecting new spyware. This paper presents a Spyware detection approach by using Data Mining (DM) technologies. Our approach is inspired by DM-based malicious code detectors, which are known to work well for detecting viruses and similar software. However, this type of detector has not been investigated in terms of how well it is able to detect spyware. We extract binary features, called n-grams, from both spyware and legitimate software and apply five different supervised learning algorithms to train classifiers that are able to classify unknown binaries by analyzing extracted n-grams. The experimental results suggest that our method is successful even when the training data is scarce.

Accurate Adware Detection Using Opcode Sequence Extraction

“…This time, researchers applied Bagging and were successful in achieving 96 per cent accuracy [15]. In an attempt to detect spyware, n-grams of hexadecimal representation were used as features [16]. This attempt was successful in obtaining 90.5 per cent accuracy.…”

MalPEFinder: fast and retrospective assessment of data breaches in malware attacks

“…MalPEFinder now provides a file attributes vector, including hash, name, and size of files, to complete the file matching; these file attributes can be extracted from PEFs conveniently and shorten the response time for malware attacks. Meanwhile, some malware file attributes found in the research can be quickly added to the vector structure to increase the detection rate of MalPEFinder.…”

A Novel Behavioural Screenlogger Detection System

“…Spyware can be defined as software that gathers information about a person or organisation without their consent or knowledge and sends it to another entity [28]. The software is designed for secrecy and durability.…”

“…Spyware is usually organised in multiple modules, each performing one or more malicious activities, with the ability to use them according to the attacker's purpose [3]. Typical spyware modules include keystroke logging, screen logging, URL monitoring, turning on the microphone or camera, intercepting sensitive documents and exfiltrating them and collecting location information [28].…”