NDLI: A virus detection scheme based on features of Control Flow Graph

Content Provider	IEEE Xplore Digital Library
Author	Zongqu Zhao
Copyright Year	2011
Description	Author affiliation: School of Computer Science and Technology, Henan Polytechnic University, Jiaozuo, China (Zongqu Zhao)
Abstract	For the well-known reasons, the virus detection schemes based on signature manifest unsatisfactory performance when they dispose the previously unknown virus. Recently, machine learning methods were introduced to build new ways for virus detection. They adopted classification algorithms to learn patterns in the binary code files in order to classify unknown files. In this paper, we present a graph features based method, which can be used in the process of machine learning, and design a virus detection model based on our feature method. The features are extracted from Control Flow Graph (CFG) of executable. We follow a threefold research methodology in our detection model: (1) create the CFG of the executables, (2) extract features from the CFG and create training data, (3) generate classifiers according to specific machine learning algorithms, and detect virus with these classifiers. For the sake of fixed sum of features, our model avoids situation that too much features could be found in other feature methods and leaves the filter step out of it, so it presents the efficient and scalability. With our experiments, we were able to achieve as high as 95.9% detection rate and as low as 5.9% false positive rate on novel malware.
Starting Page	943
Ending Page	947
File Size	218429
Page Count	5
File Format	PDF
ISBN	9781457705359
e-ISBN	9781457705366
DOI	10.1109/AIMSEC.2011.6010676
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2011-08-08
Publisher Place	China
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Accuracy Machine learning Feature extraction Malware Software Virus detection Data mining Bagging Control flow graph
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in