NDLI: Large-Scale Identification of Malicious Singleton Files

Please wait, while we are loading the content...

Research Issues and Approaches for Connected and Automated Vehicles

Ghostbuster: A Fine-grained Approach for Anomaly Detection in File System Accesses

Canonical Completeness in Lattice-Based Languages for Attribute-Based Access Control

Privacy-Preserving HMM Forward Computation

Achieving Differential Privacy in Secure Multiparty Data Aggregation Protocols on Star Networks

Sound and Static Analysis of Session Fixation Vulnerabilities in PHP Web Applications

The Human Capital Model for Security Research: New Insights into Technology Transition

PT-CFI: Transparent Backward-Edge Control Flow Violation Detection Using Intel Processor Trace

Panel: Trustworthy Data Science

Detecting ROP with Statistical Learning of Program Characteristics

All Your VMs are Disconnected: Attacking Hardware Virtualized Network

Ripple: Reflection Analysis for Android Apps in Incomplete Information Environments

Aegis: Automatic Enforcement of Security Policies in Workflow-driven Web Applications

Mining Attributed Graphs for Threat Intelligence

Classifying and Comparing Attribute-Based and Relationship-Based Access Control

Share a pie?: Privacy-Preserving Knowledge Base Export through Count-min Sketches

"If You Can't Beat them, Join them": A Usability Approach to Interdependent Privacy in Cloud Apps

A New Bloom Filter Structure for Searchable Encryption Schemes

Detecting Patching of Executables without System Calls

Large-Scale Identification of Malicious Singleton Files

SGXIO: Generic Trusted I/O Path for Intel SGX

Detecting Mobile Application Spoofing Attacks by Leveraging User Visual Similarity Perception

Discovering Browser Extensions via Web Accessible Resources

Decompression Quines and Anti-Viruses

SAMPAC: Socially-Aware collaborative Multi-Party Access Control

Efficient Commodity Matching for Privacy-Preserving Two-Party Bartering

Seamless and Secure Bluetooth LE Connection Migration

Fault Attacks on Encrypted General Purpose Compute Platforms

Scalable Function Call Graph-based Malware Classification

A Study of Security Vulnerabilities on Docker Hub

Deep Android Malware Detection

Graph Automorphism-Based, Semantics-Preserving Security for the Resource Description Framework (RDF)

Statistical Security Incident Forensics against Data Falsification in Smart Grid Advanced Metering Infrastructure

Differentially-Private Big Data Analytics for High-Speed Research Network Traffic Measurement

Analysis of Exception-Based Control Transfers

DroidSieve: Fast and Accurate Classification of Obfuscated Android Malware

Secure Free-Floating Car Sharing for Offline Cars

Comprehensive Method for Detecting Phishing EmailsUsing Correlation-based Analysis and User Participation

Identifying HTTPS-Protected Netflix Videos in Real-Time

Prioritized Analysis of Inter-App Communication Risks

The Authorization Policy Existence Problem

Towards Practical Privacy-Preserving Life Cycle Assessment Computations

Large-Scale Identification of Malicious Singleton Files

Content Provider	ACM Digital Library
Author	Li, Bo Vorobeychik, Yevgeniy Gates, Chris Roundy, Kevin
Abstract	We study a dataset of billions of program binary files that appeared on 100 million computers over the course of 12 months, discovering that 94% of these files were present on a single machine. Though malware polymorphism is one cause for the large number of singleton files, additional factors also contribute to polymorphism, given that the ratio of benign to malicious singleton files is 80:1. The huge number of benign singletons makes it challenging to reliably identify the minority of malicious singletons. We present a large-scale study of the properties, characteristics, and distribution of benign and malicious singleton files. We leverage the insights from this study to build a classifier based purely on static features to identify 92% of the remaining malicious singletons at a 1.4% percent false positive rate, despite heavy use of obfuscation and packing techniques by most malicious singleton files that we make no attempt to de-obfuscate. Finally, we demonstrate robustness of our classifier to important classes of automated evasion attacks.
Starting Page	227
Ending Page	238
Page Count	12
File Format	PDF
ISBN	9781450345231
DOI	10.1145/3029806.3029815
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2017-03-22
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Singleton files Machine learning Security Large-scale malware detection
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Hidost: a static machine-learning-based detector of malicious files

A Layered Detection Method for Malware Identification

Malware Detection in PDF Files Using Machine Learning

Real-Time Detection of Malware Downloads via Large-Scale URL->File->Machine Graph Mining

Malware Detection in PDF Files Using Machine Learning

Keeping pace with the creation of new malicious PDF files using an active-learning based detection framework

Static detection of malicious JavaScript-bearing PDF documents

Combining Crowd Contributions with Machine Learning to Detect Malicious Mobile Apps

Machine learning for attack vector identification in malicious source code

Large-Scale Identification of Malicious Singleton Files

Similar Documents

Hidost: a static machine-learning-based detector of malicious files

A Layered Detection Method for Malware Identification

Malware Detection in PDF Files Using Machine Learning

Real-Time Detection of Malware Downloads via Large-Scale URL->File->Machine Graph Mining

Malware Detection in PDF Files Using Machine Learning

Keeping pace with the creation of new malicious PDF files using an active-learning based detection framework

Static detection of malicious JavaScript-bearing PDF documents

Combining Crowd Contributions with Machine Learning to Detect Malicious Mobile Apps

Machine learning for attack vector identification in malicious source code

Large-Scale Identification of Malicious Singleton Files