NDLI: Machine learning for implanted malicious code detection with incompletely specified system implementations

Content Provider	IEEE Xplore Digital Library
Author	Yating Hsu Lee, D.
Copyright Year	2011
Description	Author affiliation: Department of Computer Science and Engineering, The Ohio State University, Columbus, OH 43210, USA (Yating Hsu; Lee, D.)
Abstract	In 2009 UnrealIRCd 3.2.8.1, an IRC (Internet Relay Chat) server, was replaced by a version with a backdoor at its mirror sites. It was not detected until seven months later and it had caused irrevocable damages in IRC services. It is of vital importance and also a challenge to detect implanted malicious code in newly developed systems before their deployment. We apply machine learning to uncover a system implementation structure that includes its normal functions from the design, as well as the hidden malicious behaviors. Published works with machine learning often assume that systems are completely specified. Unfortunately, practical system implementations are usually incompletely specified and the prevalent algorithms do not apply. We design generalized and efficient machine learning algorithms for incompletely specified protocol system implementations for detecting implanted malicious code. We further extend the results where machine learning starts from an approximate model instead of an empty conjecture — a usual approach of machine learning algorithms, and our approach learns an implementation structure more efficiently than the known algorithms. We implement and apply our method to two case studies: an IRC server with backdoor and an MSN client with message flooder. Experiments show that our procedures successfully and efficiently detect the implanted malicious behaviors.
Starting Page	31
Ending Page	36
File Size	395337
Page Count	6
File Format	PDF
ISBN	9781457713927
e-ISBN	9781457713941
DOI	10.1109/ICNP.2011.6089070
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2011-10-17
Publisher Place	Canada
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Protocols Servers Machine learning Automata Machine learning algorithms Approximation algorithms Reverse engineering machine learning implanted malicious code incompletely specified system
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Malicious code detection with integrated behavior analysis

Reverse Engineering of Protocols from Network Traces

Machine Learning Based File Entropy Analysis for Ransomware Detection in Backup Systems

Testing Security Properties of Protocol Implementations - a Machine Learning Based Approach

Pattern-recognizing stochastic learning automata

An Enhanced Passive Testing Approach for Network Protocols

A novel approach for malicious nodes detection in ad-hoc networks based on cellular learning automata

A binary analysis method for protocol deviation discovery from implementations

A Machine Learning Based Reputation System for Defending Against Malicious Node Behavior

Machine learning for implanted malicious code detection with incompletely specified system implementations

Similar Documents

Malicious code detection with integrated behavior analysis

Reverse Engineering of Protocols from Network Traces

Machine Learning Based File Entropy Analysis for Ransomware Detection in Backup Systems

Testing Security Properties of Protocol Implementations - a Machine Learning Based Approach

Pattern-recognizing stochastic learning automata

An Enhanced Passive Testing Approach for Network Protocols

A novel approach for malicious nodes detection in ad-hoc networks based on cellular learning automata

A binary analysis method for protocol deviation discovery from implementations

A Machine Learning Based Reputation System for Defending Against Malicious Node Behavior

Machine learning for implanted malicious code detection with incompletely specified system implementations