SplitScreen: Enabling efficient, distributed malware detection

Abstract

We present the design and implementation of a novel anti-malware system called SplitScreen. SplitScreen performs an additional screening step prior to the signature matching phase found in existing approaches. The screening step filters out most non-infected files (90%) and also identifies malware signatures that are not of interest (99%). The screening step significantly improves end-to-end performance because safe files are quickly identified and are not processed further, and malware files can subsequently be scanned using only the signatures that are necessary. Our approach naturally leads to a network-based anti-malware solution in which clients only receive signatures they needed, not every malware signature ever created as with current approaches. We have implemented SplitScreen as an extension to Cla-mAV [13], the most popular open source anti-malware software. For the current number of signatures, our implementation is 2× faster and requires 2× less memory than the original ClamAV. These gaps widen as the number of signatures grows.

MWMon: A Software Defined Network-based Malware Monitor

“…Cloud [4] Wireless Network [13] Access Control [14] [15,16,22,26]. Also, there is a solution designed for Android mobile devices [17].…”

“…After analyzing the file, the server sends the result to the client, and then CloudAV determines whether to block the file or not on the basis of the result. Because CloudAV, however, sends the files to the server to examine, it may violate the privacy of users who handle sensitive data [15,16].…”

“…SplitScreen [16] proposes the cloud-based signature antivirus. To reduce violating the privacy, SplitScreen sends a bit vector of a file which showed the suspicious result from the prematch to the server instead of sending the whole of the file.…”

Endpoint Security in Networks: An OpenMP Approach for Increasing Malware Detection Speed

“…Increasingly sophisticated antivirus software added to the growing amount and complexity of malware demands more processing power from personal computers, more specifically from the central processor unit (CPU) [7].…”

A Classification Method for Executable Files based on Comparison of Undocumented Information in the PE Header

“…, ClamAV [19]를 확장하여 악 성코드를 탐지하는 방법 [10], 명령어 빈도수를 이용한 방법 [3], 함수의 길이를 이용한 방법 [6], 함수 호출 그래프를 이용한 방법 [8], 바이트 레벨 파일 컨텐츠 분석 방법 [7], API 조합을 이용한 윈도우 악성행위 분류 기법 [11] 참 고 문 헌…”