Multinomial malware classification via low-level features

Banin, Sergii; Dyrkolbotn, Geir Olav

doi:10.1016/j.diin.2018.04.019

Cited by 29 publications

(18 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…A previous work [8] presented an attempt to fill the gap between low-level activity (memory access patterns) and its high-level (more human understandable API calls) representation. During the study it was also found, that under the experimental design used in [8] and [7] most of the recorded behavioral activity emerged not from the main module of an executable (after the Entry Point 1 -AEP) but prior to the moment when instruction pointer (IP) is set to the Entry Point (before the Entry Point -BEP). Without going into much details (see Section 2 for details) these findings showed, that it is potentially possible to detect running malicious executable before it starts executing the logic that was put into it by the creator.…”

Section: Introductionmentioning

confidence: 98%

“…API and system calls, network and file activity are some of the high-level features, while memory access operations, opcodes or hardware performance counters are the low-level features. Basically we perceive behavioral features that emerge from the system's hardware as the low-level ones [7] [13] [20]. Static features are easier to change for an attacker utilizing techniques such as obfuscation or encryption.…”

Section: Introductionmentioning

confidence: 99%

“…Moreover, as soon as malware is launched -it is impossible to avoid execution on the system's hardware. That's why in this paper we use low-level features such as memory access patterns for malware detection [9] and classification [7].…”

Section: Introductionmentioning

confidence: 99%

“…Memory access patterns previously were proven to be effective features for malware detection [9] and classification [7]. A memory access pattern is a sequence of read and write operations performed by an executable and will be described in details in Section 3.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Detection of Running Malware Before it Becomes Malicious

Banin¹,

Dyrkolbotn²

2020

Advances in Information and Computer Security

Self Cite

View full text Add to dashboard Cite

As more vulnerabilities are being discovered every year[17], malware constantly evolves forcing improvements and updates of security and malware detection mechanisms. Malware is used directly on the attacked systems, thus anti-virus solutions tend to neutralize malware by not letting it launch or even being stored in the system. However, if malware is launched it is important to stop it as soon as the maliciousness of a new process has been detected. Following the results from [8] in this paper we show, that it is possible to detect running malware before it becomes malicious. We propose a novel malware detection approach that is capable of detecting Windows malware on the earliest stage of execution. The accuracy of more than 99% has been achieved by finding distinctive low-level behavior patterns generated before malware reaches it's entry point. We also study the ability of our approach to detect malware after it reaches it's entry point and to distinguish between benign executables and 10 malware families.

show abstract

Section: Introductionmentioning

confidence: 98%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Detection of Running Malware Before it Becomes Malicious

Banin¹,

Dyrkolbotn²

2020

Advances in Information and Computer Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…Kodun istifadə etdiyi kitabxanalar "stub" adı verilən, daha sonra əsliylə dəyişdiriləcək müvəqqəti kod hissələri ilə dəyişdirilir. Aşağıdakı inyeksiya növlərini kimi göstərmək olar: proseslərin inyeksiyası, kitabxanaların inyeksiyası, yüklənmədən qabaq mühitin inyeksiyası [6].…”

Section: şəKil 3 Hooking Prosesiunclassified

Kompüter şəbəkələrində zərərli proqramların analizi üsulları

Yunusov¹

2018

İnformasiya Təhlükəsizliyinin Aktual Multidissiplinar Elmi-Praktiki Problemləri IV Respublika Konfransının Materialları

View full text Add to dashboard Cite

Xülasə-Məqalədə kompüter şəbəkələrinin təhlükəsizliyi, zərərli proqramlar haqqında informasiya verilmişdir, zərərli proqramların analizi üsulları, statik analiz üsulu, dinamik analiz üsulu, zərərli proqramların virtual mühitdə analizi, zərərli proqramların yoluxma üsulları tədqiq olunmuşdur. Açar sözlər-kompüter şəbəkələri, zərərli proqramlar, rootkit, zərərli mobil kod, kuki faylları, hooking, sandbox.

show abstract

A Deep Malware Detection Method Based on General-Purpose Register Features

Yan

Zhu

et al. 2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Multinomial malware classification via low-level features

Cited by 29 publications

References 7 publications

Detection of Running Malware Before it Becomes Malicious

Detection of Running Malware Before it Becomes Malicious

Kompüter şəbəkələrində zərərli proqramların analizi üsulları

A Deep Malware Detection Method Based on General-Purpose Register Features

Contact Info

Product

Resources

About