ECFGM: enriched control flow graph miner for unknown vicious infected code detection

Eskandari, Mojtaba; Hashemi, Sattar

doi:10.1007/s11416-012-0169-9

Cited by 11 publications

(7 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We start with file classification techniques including static and dynamic analysis. In static analysis, students learn three major classes of features including: Binary N-grams [45][46][47][48], Control Flow Graphs (CFGs) [49][50][51] and Static features/Disassembling [52,53]. Although static analysis techniques are efficient, most recent malware are sophisticated and has polymorphic nature, which hinder the effectiveness of static analysis.…”

Section: Module 4: Ai Assisted Malware Detectionmentioning

confidence: 99%

AI assisted Malware Analysis: A Course for Next Generation Cybersecurity Workforce

Gupta¹,

Mittal²,

Abdelsalam³

2020

Preprint

View full text Add to dashboard Cite

The use of Artificial Intelligence (AI) and Machine Learning (ML) to solve cybersecurity problems has been gaining traction within industry and academia, in part as a response to widespread malware attacks on critical systems, such as cloud infrastructures, government offices or hospitals, and the vast amounts of data they generate. AIand ML-assisted cybersecurity offers data-driven automation that could enable security systems to identify and respond to cyber threats in real time. However, there is currently a shortfall of professionals trained in AI and ML for cybersecurity. Here we address the shortfall by developing lab-intensive modules that enable undergraduate and graduate students to gain fundamental and advanced knowledge in applying AI and ML techniques to real-world datasets to learn about Cyber Threat Intelligence (CTI), malware analysis, and classification, among other important topics in cybersecurity.Here we describe six self-contained and adaptive modules in "AI-assisted Malware Analysis." Topics include: (1) CTI and malware attack stages, (2) malware knowledge representation and CTI sharing, (3) malware data collection and feature identification, (4) AI-assisted malware detection, (5) malware classification and attribution, and (6) advanced malware research topics and case studies such as adversarial learning and Advanced Persistent Threat (APT) detection.

show abstract

Section: Module 4: Ai Assisted Malware Detectionmentioning

confidence: 99%

AI assisted Malware Analysis: A Course for Next Generation Cybersecurity Workforce

Gupta¹,

Mittal²,

Abdelsalam³

2020

Preprint

View full text Add to dashboard Cite

show abstract

“…The method presented in [11,12] uses CFG for visualizing the control structure and representing the semantic aspects of a Annotated Control Flow Graph for Metamorphic Malware Detection 3 program. They extended the CFG with the extracted API calls to have more information about the executable program.…”

Section: Related Workmentioning

confidence: 99%

“…The CFG of a program represents all the paths that can be taken during the program execution. Current techniques [11][12][13][14][15][16][17][18][19][20] that use CFG for malware detection are compute intensive (others have poor detection rate) and cannot handle malware with smaller CFGs.…”

Section: Introductionmentioning

confidence: 99%

Annotated Control Flow Graph for Metamorphic Malware Detection

Alam

Traoré

Soğukpınar

2014

The Computer Journal

View full text Add to dashboard Cite

Metamorphism is a technique that mutates the binary code using different obfuscations and never keeps the same sequence of opcodes in the memory. This stealth technique provides the capability to a malware for evading detection by simple signature-based (such as instruction sequences, byte sequences and string signatures) anti-malware programs. In this paper, we present a new scheme named Annotated Control Flow Graph (ACFG) to efficiently detect such kinds of malware. ACFG is built by annotating CFG of a binary program and is used for graph and pattern matching to analyse and detect metamorphic malware. We also optimize the runtime of malware detection through parallelization and ACFG reduction, maintaining the same accuracy (without ACFG reduction) for malware detection. ACFG proposed in this paper: (i) captures the control flow semantics of a program; (ii) provides a faster matching of ACFGs and can handle malware with smaller CFGs, compared with other such techniques, without compromising the accuracy; (iii) contains more information and hence provides more accuracy than a CFG. Experimental evaluation of the proposed scheme using an existing dataset yields malware detection rate of 98.9% and false positive rate of 4.5%.

show abstract

“…Another approach that uses CFGs to recognise viral code, which is infected a sane programme, is introduced in . This approach modifies the CFG model in order to make an enriched CFG.…”

Section: Related Workmentioning

confidence: 99%

Frequent sub‐graph mining for intelligent malware detection

Eskandari

Raesi

2014

Security Comm Networks

Self Cite

View full text Add to dashboard Cite

Malware is a serious threat that has caused catastrophic disasters in recent decades. To deal with this issue, various approaches have been proposed. One effective and widely used method is signature‐based detection. However, there is a substantial problem in detecting new instances; therefore, this method is solely useful for second malware attacks. In addition, owing to the rapid proliferation of malware and the significant human effort requirement to extract signatures, this approach is an inadequate solution; thus, an intelligent malware detection system is required. One of the major phases of such a system is feature extraction, used to construct a learning model. This paper introduces an approach to generate a group of semantic signatures, represented by a set of learning models, in which various features indicate the different programming styles of the execution files. A set of these signatures is obtained by mining frequent sub‐graphs, common code sub‐structures employed for malware writing, in a group of control flow graphs. The experimental results depict an improved F‐measure rate in comparison with the classic graph‐based approach. Copyright © 2014 John Wiley & Sons, Ltd.

show abstract

ECFGM: enriched control flow graph miner for unknown vicious infected code detection

Cited by 11 publications

References 22 publications

AI assisted Malware Analysis: A Course for Next Generation Cybersecurity Workforce

AI assisted Malware Analysis: A Course for Next Generation Cybersecurity Workforce

Annotated Control Flow Graph for Metamorphic Malware Detection

Frequent sub‐graph mining for intelligent malware detection

Contact Info

Product

Resources

About