NDLI: Clustering of Similar Malware Behavior via Structural Host-Sequence Comparison

Content Provider	IEEE Xplore Digital Library
Author	Horng-Tzer Wang Ching-Hao Mao Te-En Wei Hahn-Ming Lee
Copyright Year	2013
Description	Author affiliation: Dept. of Comput. Sci. & Inf. Eng., Nat. Taiwan Univ. of Sci. & Technol., Taipei, Taiwan (Horng-Tzer Wang; Te-En Wei; Hahn-Ming Lee) \|\| Inst. for Inf. Ind., Taipei, Taiwan (Ching-Hao Mao)
Abstract	Malware (malicious software) is used by attackers to gain access to end-users' computing devices with the aim of performing malicious actions, such as sending spam, downloading malicious files, and stealing private information. Furthermore, malicious actions result in the infection of many machines at considerable monetary expense to affected end-users. Although anti-malware companies can detect malware, they generally rely on signature-based methods. Because attackers use automated malware generation tools to generate new or modified malware that leads to increased instances and variants of malware, variants of the same malware class can often evade such methods. In this study, we propose a system based on structural sequence comparison and probabilistic similarity measures for detecting variants of a malware class. We believe that the structural sequence of malware behavior can detect variants of the same malware class by profiling the relationship between different behavior patterns. Furthermore, probabilistic similarity measures are used for discovering the behavior patterns of the sequential relation and finding very similar behavior models of malware classes. The proposed system, which incorporates a structural sequence mechanism and probabilistic similarity measurement, can be helpful for detecting and discovering variants of a malware class. The results of our experiment show that the proposed system detects variants of a malware class more effectively than a two-gram sequence does, and it lowers the effect and weight of behavior patterns, with higher precision and F-measure in variants of malware detection than the approach based on a two-gram sequence and normalized embedding function.
Starting Page	349
Ending Page	358
File Size	813960
Page Count	10
File Format	PDF
ISBN	9780769549866
ISSN	07303157
DOI	10.1109/COMPSAC.2013.60
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2013-07-22
Publisher Place	Japan
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Malware Probabilistic logic Software Mathematical model Markov processes Monitoring Companies similarity measures malware detection sequential data Markov chain
Content Type	Text
Resource Type	Article
Subject	Computer Science Applications Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Similarity-Based Clustering of Sequences Using Hidden Markov Models (2003)

Probabilistic Contract Compliance for Mobile Applications

Modeling High-Level Behavior Patterns for Precise Similarity Analysis of Software

A New Distance Measure for Model-Based Sequence Clustering

Behavior-based Malware analysis using profile hidden Markov models

Sandboxing and reasoning on malware infection trees

A study of the effects of bias in criterion functions for temporal data clustering

Malware Detection in Smartphone Using Hidden Markov Model

HM3alD: Polymorphic Malware Detection Using Program Behavior-Aware Hidden Markov Model

Clustering of Similar Malware Behavior via Structural Host-Sequence Comparison

Similar Documents

Similarity-Based Clustering of Sequences Using Hidden Markov Models (2003)

Probabilistic Contract Compliance for Mobile Applications

Modeling High-Level Behavior Patterns for Precise Similarity Analysis of Software

A New Distance Measure for Model-Based Sequence Clustering

Behavior-based Malware analysis using profile hidden Markov models

Sandboxing and reasoning on malware infection trees

A study of the effects of bias in criterion functions for temporal data clustering

Malware Detection in Smartphone Using Hidden Markov Model

HM3alD: Polymorphic Malware Detection Using Program Behavior-Aware Hidden Markov Model

Clustering of Similar Malware Behavior via Structural Host-Sequence Comparison