NDLI: A scalable approach for malware detection through bounded feature space behavior modeling

Please wait, while we are loading the content...

BOOM: experiences in language and tool design for distributed systems (keynote)

Round-up: runtime checking quasi linearizability of concurrent data structures

PIEtrace: platform independent executable trace

Operator-based and random mutant selection: better together

BLITZ: compositional bounded model checking for real-world programs

A study of repetitiveness of code changes in software evolution

Automatically synthesizing SQL queries from input-output examples

Detecting bad smells in source code using change history information

A scalable approach for malware detection through bounded feature space behavior modeling

Improving bug localization using structured information retrieval

Characterizing and detecting resource leaks in android applications

TzuYu: learning stateful typestates

Measuring the structural complexity of feature models

Software analytics for incident management of online services: an experience report

Automated unit testing of large industrial embedded software using concolic testing

AutoComment: mining question and answer sites for automatic comment generation

PYTHIA: generating test cases with oracles for JavaScript applications

A pattern-based approach to parametric specification mining

Model repair and transformation with Echo

Detecting and fixing emergent behaviors in distributed software systems using a message content independent method

The challenges of verification and validation of automated planning systems (keynote)

Constraint-based automatic symmetry detection

Improving efficiency of dynamic analysis with dynamic dependence summaries

Testing properties of dataflow program operators

Ranger: parallel analysis of alloy models by range partitioning

Consistency-preserving edit scripts in model versioning

SEDGE: symbolic example data generation for dataflow programs

Personalized defect prediction

Automatically partition software into least privilege components using dynamic data dependency analysis

Leveraging program equivalence for adaptive program repair: models and first results

Dangling references in multi-configuration and dynamic PHP-based web applications

Mining branching-time scenarios

Scalable product line configuration: a straw to break the camel's back

A comparative analysis of software architecture recovery techniques

Minimizing CPU time shortage risks in integrated embedded software

Detecting system use cases and validations from documents

Randomizing regression tests using game theory

Semi-automatic generation of metamodels from model sketches

Smart cloud broker: finding your home in the clouds

Synthesizing fault-tolerant programs from deontic logic specifications

Big problems in industry (panel)

Proving MCAPI executions are correct using SMT

Efficient parametric runtime verification with deterministic string rewriting

Bita: Coverage-guided, automatic testing of actor programs

Automated verification of pattern-based interaction invariants in Ajax applications

JFlow: practical refactorings for flow-based parallelism

Characteristic studies of loop problems for structural test generation via symbolic execution

Automatic recommendation of API methods from feature requests

Finding architectural flaws using constraints

Detecting and characterizing semantic inconsistencies in ported code

Dynamically transforming data structures

Towards contextual and on-demand code clone management by continuous monitoring

Model based test validation and oracles for data acquisition systems

Multi-user variability configuration: a game theoretic approach

Automated inference of classifications and dependencies for combinatorial testing

Assessing the maturity of requirements through argumentation: a good enough approach

OCRA: a tool for checking the refinement of temporal contracts

Supporting bug investigation using history analysis

Efficient data race prediction with incremental reasoning on time-stamped lock history

Identifying execution points for dynamic analyses

SABRINE: state-based robustness testing of operating systems

Software model checking for distributed systems with selector-based, non-blocking communication

Automated planning for software architecture evolution

Entropy-based test generation for improved fault localization

Variability-aware performance prediction: a statistical learning approach

Lightweight control-flow instrumentation and postmortem analysis in support of debugging

Towards precise metrics for predicting graph query performance

The potential of polyhedral optimization: an empirical study

Automated verification of interactive rule-based configuration systems

From comparison matrix to variability model: the Wikipedia case study

Adding context to fault localization with integration coverage

Natural language requirements quality analysis based on business domain models

The bounded model checker LLBMC

Context-aware task allocation for distributed agile team

Learning effective query transformations for enhanced requirements trace retrieval

Using automatically generated invariants for regression testing and bug localization

Model/code co-refactoring: an MDE approach

CSeq: a concurrency pre-processor for sequential C verification tools

Preventing erosion of architectural tactics through their strategic implementation, preservation and visualization

Environment rematching: toward dependability improvement for self-adaptive applications

Class level fault prediction using software clustering

Recovering model transformation traces using multi-objective optimization

Automated testing of cloud-based elastic systems with AUToCLES

Cloud twin: native execution of android applications on the windows phone

ExPort: detecting and visualizing API usages in large source code repositories

Tool support for automatic model transformation specification using concrete visualisations

SBFR: a search based approach for reproducing failures of programs with grammar based input

Flow permissions for android

CCmutator: a mutation generator for concurrency constructs in multithreaded C/C++ applications

Crushinator: a framework towards game-independent testing

Pex4Fun: a web-based environment for educational gaming via automated test generation

Developing self-verifying service-based systems

TRAM: a tool for transforming textual requirements into analysis models

iProbe: a lightweight user-level dynamic instrumentation tool

A scalable approach for malware detection through bounded feature space behavior modeling

Content Provider	ACM Digital Library
Author	Tan, Hee Beng Kuan Padmanabhuni, Bindu Madhavi Briand, Lionel C. Shar, Lwin Khin Chandramohan, Mahinthan
Abstract	In recent years, malware (malicious software) has greatly evolved and has become very sophisticated. The evolution of malware makes it difficult to detect using traditional signature-based malware detectors. Thus, researchers have proposed various behavior-based malware detection techniques to mitigate this problem. However, there are still serious shortcomings, related to scalability and computational complexity, in existing malware behavior modeling techniques. This raises questions about the practical applicability of these techniques. This paper proposes and evaluates a bounded feature space behavior modeling (BOFM) framework for scalable malware detection. BOFM models the interactions between software (which can be malware or benign) and security-critical OS resources in a scalable manner. Information collected at run-time according to this model is then used by machine learning algorithms to learn how to accurately classify software as malware or benign. One of the key problems with simple malware behavior modeling (e.g., n-gram model) is that the number of malware features (i.e., signatures) grows proportional to the size of execution traces, with a resulting malware feature space that is so large that it makes the detection process very challenging. On the other hand, in BOFM, the malware feature space is bounded by an upper limit N, a constant, and the results of our experiments show that its computation time and memory usage are vastly lower than in currently reported, malware detection techniques, while preserving or even improving their high detection accuracy.
Starting Page	312
Ending Page	322
Page Count	11
File Format	PDF
ISBN	9781479902156
DOI	10.1109/ASE.2013.6693090
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2013-11-11
Access Restriction	Subscribed
Subject Keyword	Malware behavior modeling Malware detection
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in