Growing Grapes in Your Computer to Defend Against Malware

Shan, Zhiyong; Wang, Xin

doi:10.1109/tifs.2013.2291066

Cited by 28 publications

(15 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Therefore, the only concern is the generated partial logs that result into misclassification. Although, in our case the false alarm rates were significantly low as compared to other existing approaches [6], [20], [30], [40]. This particular limitation is common to the majority of dynamic malware detection approaches.…”

Section: A Generalitycontrasting

confidence: 53%

“…For this, we may first extract the common subgraph (using graph isomorphism [47]) from all malware and benign samples and then the edges of this subgraph can be removed from all the OSCGs. However, the false alarm rate in our approach is considerably low when compared to approaches [6], [40], and [20] in which the false alarm rate of 10.9%, 9.8% and 9.7% is observed respectively.…”

Section: Detection Accuracymentioning

confidence: 69%

“…Although, Microsoft abandoned its support for XP but still it is a popular OS widely used in various government agencies, banks and in ATMs. As a result, existing recent similar approaches [6], [11], [14], [40] also utilize XP. However, the proposed approach is not specific to particular OS and analysis framework as: 1) the target malicious binaries (PE format) affect all Windows platforms, and 2) system-call sequence used in Windows XP is a subset of those utilized in Windows 7 [32].…”

Section: Experimental Setup and Resultsmentioning

confidence: 99%

“…Analyzing a malware sample to identify the unique static markers requires greater efforts as the effectiveness of these markers is hampered by obfuscation and morphism (polymorphism and metamorphism) techniques. As a consequence, the static methods for malware detection may not capture unknown malware instances [6]. To nullify the effects of obfuscation, polymorphism and metamorphism on malware executables, researchers have given preference to dynamic malware detection approaches.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Employing Program Semantics for Malware Detection

Naval

Laxmi

Rajarajan

et al. 2015

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

This is the accepted version of the paper.This version of the publication may differ from the final published version. Abstract-In recent years, malware has emerged as a critical security threat. Additionally, malware authors continue to embed numerous anti-detection features to evade existing malware detection approaches. Against this advanced class of malicious programs, dynamic behavior-based malware detection approaches outperform the traditional signature-based approaches by neutralizing the effects of obfuscation and morphing techniques. The majority of dynamic behavior detectors rely on system-calls to model the infection and propagation dynamics of malware. However, these approaches do not account an important antidetection feature of modern malware, i.e., system-call injection attack. This attack allows the malicious binaries to inject irrelevant and independent system-calls during the program execution thus modifying the execution sequences defeating the existing system-call based detection. To address this problem, we propose an evasion-proof solution that is not vulnerable to system-call injection attacks. Our proposed approach precisely characterizes the program semantics using Asymptotic Equipartition Property (AEP) mainly applied in information theoretic domain. The AEP allows us to extract the information-rich call sequences that are further quantified to detect the malicious binaries. Furthermore, the proposed detection model is less vulnerable to call-injection attacks as the discriminating components are not directly visible to malware authors. This particular characteristic of proposed approach hampers a malware author's aim of defeating our approach. We run a thorough set of experiments to evaluate our solution and compare it with existing systemcall based malware detection techniques. The results demonstrate that the proposed solution is effective in identifying real malware instances. Permanent repository link

show abstract

Section: A Generalitycontrasting

confidence: 53%

Section: Detection Accuracymentioning

confidence: 69%

Section: Experimental Setup and Resultsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Employing Program Semantics for Malware Detection

Naval

Laxmi

Rajarajan

et al. 2015

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

show abstract

“…In the past few decades there are a lot of security research work on the Windows platform in order to enhance its security and protect sensitive data, including malware analysis and detection [3][4][5] and the state-of-the-art vulnerability exploits and mitigations [6][7][8][9][10][11].…”

Section: Introductionmentioning

confidence: 99%

PMCAP: A Threat Model of Process Memory Data on the Windows Operating System

Pan

Zhuang

2017

Security and Communication Networks

View full text Add to dashboard Cite

Research on endpoint security involves both traditional PC platform and prevalent mobile platform, among which the analysis of software vulnerability and malware is one of the important contents. For researchers, it is necessary to carry out nonstop exploration of the insecure factors in order to better protect the endpoints. Driven by this motivation, we propose a new threat model named Process Memory Captor (PMCAP) on the Windows operating system which threatens the live process volatile memory data. Compared with other threats, PMCAP aims at dynamic data in the process memory and uses a noninvasive approach for data extraction. In this paper we describe and analyze the model and then give a detailed implementation taking four popular web browsers IE, Edge, Chrome, and Firefox as examples. Finally, the model is verified through real experiments and case studies. Compared with existing technologies, PMCAP can extract valuable data at a lower cost; some techniques in the model are also suitable for memory forensics and malware analysis.

show abstract

Statistical fingerprint‐based intrusion detection system (SF‐IDS)

Boero

Cello

Marchese

et al. 2016

Int J Communication

View full text Add to dashboard Cite

Summary Intrusion detection systems (IDS) are systems aimed at analyzing and detecting security problems. The IDS may be structured into misuse and anomaly detection. The former are often signature/rule IDS that detect malicious software by inspecting the content of packets or files looking for a “signature” labeling malware. They are often very efficient, but their drawback stands in the weakness of the information to check (eg, the signature), which may be quickly dated, and in the computation time because each packet or file needs to be inspected. The IDS based on anomaly detection and, in particular, on statistical analysis have been originated to bypass the mentioned problems. Instead of inspecting packets, each traffic flow is observed so getting a statistical characterization, which represents the fingerprint of the flow. This paper introduces a statistical analysis based intrusion detection system, which, after extracting the statistical fingerprint, uses machine learning classifiers to decide whether a flow is affected by malware or not. A large set of tests is presented. The obtained results allow selecting the best classifiers and show the performance of a decision maker that exploits the decisions of a bank of classifiers acting in parallel.

show abstract

Growing Grapes in Your Computer to Defend Against Malware

Cited by 28 publications

References 14 publications

Employing Program Semantics for Malware Detection

Employing Program Semantics for Malware Detection

PMCAP: A Threat Model of Process Memory Data on the Windows Operating System

Statistical fingerprint‐based intrusion detection system (SF‐IDS)

Contact Info

Product

Resources

About