Automated Malware Detection Based on Novel Network Behavioral Signatures

Abstract

Abstract-In this paper we introduce the second generation of the experimental detection framework of AIPS system which is used for experimentation with detection models and with their combinations. Our research aims mainly on detection of attacks that abuse vulnerabilities of buffer overflow type, but the final goal is to extend detection techniques to cover various types of vulnerabilities. This article describes the concept of detection framework, updated set of network metrics, provides a design of model architecture and shows an experimental results with draft of framework on the set of laboratory simulated attacks.Index Terms-Artificial intelligence, behavioral signatures, metrics, network security, security, security design.

A Malware Obfuscation AI Technique to Evade Antivirus Detection in Counter Forensic Domain

“…Both papers [30,26] had similar contribution idea to the one presented in [31], the main idea behind their studies is to use sandboxes in order to decrease the false positives.…”

Detection of network buffer overflow attacks: A case study

“…In previous articles [1] [2] we proposed an idea of framework architecture that would be used for detection of various network threats. The papers presented the novel Automated Intrusion Prevention System (AlPS) which uses honeypot systems for the detection of new attacks and the automatic generation of behavioral signatures based on network flow metrics.…”