NDLI: Detecting scareware by mining variable length instruction sequences

Content Provider	IEEE Xplore Digital Library
Author	Shahzad, R.K. Lavesson, N.
Copyright Year	2011
Description	Author affiliation: School of Computing, Blekinge Institute of Technology, SE-371 32 Karlskrona, Sweden (Shahzad, R.K.; Lavesson, N.)
Abstract	Scareware is a recent type of malicious software that may pose financial and privacy-related threats to novice users. Traditional countermeasures, such as anti-virus software, require regular updates and often lack the capability of detecting novel (unseen) instances. This paper presents a scareware detection method that is based on the application of machine learning algorithms to learn patterns in extracted variable length opcode sequences derived from instruction sequences of binary files. The patterns are then used to classify software as legitimate or scareware but they may also reveal interpretable behavior that is unique to either type of software. We have obtained a large number of real world scareware applications and designed a data set with 550 scareware instances and 250 benign instances. The experimental results show that several common data mining algorithms are able to generate accurate models from the data set. The Random Forest algorithm is shown to outperform the other algorithms in the experiment. Essentially, our study shows that, even though the differences between scareware and legitimate software are subtler than between, say, viruses and legitimate software, the same type of machine learning approach can be used in both of these dissimilar cases.
Starting Page	1
Ending Page	8
File Size	221920
Page Count	8
File Format	PDF
ISBN	9781457714818
e-ISBN	9781457714832
DOI	10.1109/ISSA.2011.6027523
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2011-08-15
Publisher Place	South Africa
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Vocabulary Scareware Software algorithms Classification Instruction Sequence Feature extraction Software Malware Classification algorithms Data mining
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Detecting scareware by mining variable length instruction sequences.

Accurate Adware Detection Using Opcode Sequence Extraction

Veto-based Malware Detection

Malware detection and classification based on extraction of API sequences

Classification of Malware Based on String and Function Feature Selection

Malware Function Classification Using APIs in Initial Behavior

A feature selection method for malware detection

ARIGUMA Code Analyzer: Efficient Variant Detection by Identifying Common Instruction Sequences in Malware Families

FENOC: An Ensemble One-Class Learning Framework for Malware Detection

Detecting scareware by mining variable length instruction sequences

Similar Documents

Detecting scareware by mining variable length instruction sequences.

Accurate Adware Detection Using Opcode Sequence Extraction

Veto-based Malware Detection

Malware detection and classification based on extraction of API sequences

Classification of Malware Based on String and Function Feature Selection

Malware Function Classification Using APIs in Initial Behavior

A feature selection method for malware detection

ARIGUMA Code Analyzer: Efficient Variant Detection by Identifying Common Instruction Sequences in Malware Families

FENOC: An Ensemble One-Class Learning Framework for Malware Detection

Detecting scareware by mining variable length instruction sequences