NDLI: Unknown Malware Detection Based on the Full Virtualization and SVM

Content Provider	IEEE Xplore Digital Library
Author	Hengli Zhao Ning Zheng Jian Li Jingjing Yao Qiang Hou
Copyright Year	2009
Abstract	Malware has become the centerpiece of security threats on the e-commercial business. The focus of malware research is shifting from using signature patterns to identifying the malicious behavior patterns. Many researcher extract behavior pattern from system call sequences to identify malware from benign programs with data mining techniques. Most system call tracing tools must run alongside the malware in the same system environment and could be easily detected by malware. In this paper, we propose a new system calls tracing system based on the full virtualization via Intel-VT technology. Malicious samples are running in a GuestOS and they can not detect the existence of system call tracing tool running in the HostOS. We collect a system call trace data set from 1226 malicious and 587 benign executables. An experiment based on the SVM model shows that the proposed method can detect malware with strong resilience and high accuracy.
Starting Page	473
Ending Page	476
File Size	372340
Page Count	4
File Format	PDF
ISBN	9780769537788
DOI	10.1109/ICMeCG.2009.114
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2009-09-16
Publisher Place	China
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	malware Data security full virtualization Conference management Virtual machining SVM Data mining Application virtualization Support vector machines system call Virtual machine monitors Technology management Operating systems Virtual manufacturing
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

MAVMM: Lightweight and Purpose Built VMM for Malware Analysis

Detection of Malware and Kernel-Level Rootkits in Cloud Computing Environments

Virtual machine monitors: current technology and future trends

Using Virtualization Software in Operating Systems Course

Solo: A Lightweight Virtual Machine

The Application of Virtual Machines on System Security

Intrusion detection in virtual machine environments

Empirical Performance Evaluation of Message Passing Programs Running in Virtual Machines

iKernel: Isolating Buggy and Malicious Device Drivers Using Hardware Virtualization Support

Unknown Malware Detection Based on the Full Virtualization and SVM

Similar Documents

MAVMM: Lightweight and Purpose Built VMM for Malware Analysis

Detection of Malware and Kernel-Level Rootkits in Cloud Computing Environments

Virtual machine monitors: current technology and future trends

Using Virtualization Software in Operating Systems Course

Solo: A Lightweight Virtual Machine

The Application of Virtual Machines on System Security

Intrusion detection in virtual machine environments

Empirical Performance Evaluation of Message Passing Programs Running in Virtual Machines

iKernel: Isolating Buggy and Malicious Device Drivers Using Hardware Virtualization Support

Unknown Malware Detection Based on the Full Virtualization and SVM