Host based Feature Description Method for Detecting APT Attack

Abstract

As the social and financial damages caused by APT attack such as 3.20 cyber terror are increased, the technical solution against APT attack is required. It is, however, difficult to protect APT attack with existing security equipments because the attack use a zero-day malware persistingly. In this paper, we propose a host based anomaly detection method to overcome the limitation of the conventional signature-based intrusion detection system. First, we defined 39 features to identify between normal and abnormal behavior, and then collected 8.7 million feature data set that are occurred during running both malware and normal executable file. Further, each process is represented as 83-dimensional vector that profiles the frequency of appearance of features. the vector also includes the frequency of features generated in the child processes of each process. Therefore, it is possible to represent the whole behavior information of the process while the process is running. In the experimental results which is applying C4.5 decision tree algorithm, we have confirmed 2.0% and 5.8% for the false positive and the false negative, respectively.

Feature-Chain Based Malware Detection Using Multiple Sequence Alignment of API Call

“…The decision tree has been trained and generated from the frequency count of API calls in our previous study [10] by C4.5 algorithm of WEKA [15] data mining tool. C4.5 is the popular algorithm of decision tree mechanism.…”

“…C4.5 is the popular algorithm of decision tree mechanism. About 2000 input data from both malware samples and benign applications from the previous study [10] were used to train the decision tree model. In this step, our training data with 856 malware samples was classified into 48 malware groups by this decision tree.…”