NDLI: Unknown Malicious Executables Detection Based on Run-Time Behavior

Content Provider	IEEE Xplore Digital Library
Author	Yongtao Hu Liang Chen Ming Xu Ning Zheng Yanhua Guo
Copyright Year	2008
Description	Author affiliation: Third Res. Inst., Minist. of Public Security, Shanghai (Yongtao Hu)
Abstract	Traditional anti-virus scanner employs static features to detect malicious executables. Unfortunately, this content-based approach can be obfuscated by techniques such as polymorphism and metamorphism. In this paper, we propose a malicious executable detecting method using 35-dimension feature vector. Each dimension stands for a malicious run-time behavior feature represented by corresponding Win32 API calls and their certain parameters. An automatic executable behavior tracing system (Argus) is also implemented to dynamically capture the features. Experiments are performed on a data set of 8223 malicious and 2821 benign executables. Training set is then used to generate detection model and several testing groups are set up for classification. Experiment result suggests that the method is efficient in detecting previously unknown malicious executables which have more than two behavior features captured.
Starting Page	391
Ending Page	395
File Size	255555
Page Count	5
File Format	PDF
ISBN	9780769533056
DOI	10.1109/FSKD.2008.185
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2008-10-18
Publisher Place	China
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Computer vision Data analysis Spatial databases Security malicious behavior Runtime Operating systems malicious executables Keyboards Writing Win32 API calls Fuzzy systems Testing
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Dynamic Detection of Unknown Malicious Executables Base on API Interception

Fuzzy Intrusion Detection System via Data Mining Technique with Sequences of System Calls

A Method for Detecting Unknown Malicious Executables

Static Detection of API-Calling Behavior from Malicious Binary Executables

Behavior-Based Proactive Detection of Unknown Malicious Codes

Unknown Malicious Executables Detection Based on Immune Principles

Behavior-based malicious executables detection by multi-class SVM

Data Mining Methods for Detection of New Malicious Executables

Data mining methods for detection of new malicious executables (2001)

Unknown Malicious Executables Detection Based on Run-Time Behavior

Similar Documents

Dynamic Detection of Unknown Malicious Executables Base on API Interception

Fuzzy Intrusion Detection System via Data Mining Technique with Sequences of System Calls

A Method for Detecting Unknown Malicious Executables

Static Detection of API-Calling Behavior from Malicious Binary Executables

Behavior-Based Proactive Detection of Unknown Malicious Codes

Unknown Malicious Executables Detection Based on Immune Principles

Behavior-based malicious executables detection by multi-class SVM

Data Mining Methods for Detection of New Malicious Executables

Data mining methods for detection of new malicious executables (2001)

Unknown Malicious Executables Detection Based on Run-Time Behavior