Enhancing malware detection: clients deserve more protection

Al-Saleh, Mohammed I.; Shebaro, Bilal

doi:10.1504/ijesdf.2016.073728

Cited by 3 publications

(3 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Research has been conducted to enhance the AVs scanning capability based on software solutions (Al-Saleh and Shebaro, 2016;Edwards et al, 2001;Edwards and Turner, 2010;Gassoway, 2013). Al-Saleh and Shebaro (2016) proposed an enhancement to the AV to make it scan memory-to-network and network-tomemory data.…”

Section: Related Workmentioning

confidence: 99%

“…Al-Saleh and Shebaro (2016) proposed an enhancement to the AV to make it scan memory-to-network and network-tomemory data. Their solution is based on an AV add-on feature that is capable of collecting TCP flows and scanning them incrementally upon flow changes.…”

Section: Related Workmentioning

confidence: 99%

“…For example, the AV seems to choose not to scan Only-InMemory Data. This is the kind of data that will never be written to a secondary storage such as Hard Drives (HD) Al-Saleh and Shebaro, 2016;Gionta et al, 2014). Interestingly, according to a study (Gupta et al, 2010), popular AVs do not scan data received through network into memory.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

On Improving Antivirus Scanning Engines: Memory On-Access Scanner

Al-Saleh¹,

Al-Huthaifi²

2017

Journal of Computer Science

View full text Add to dashboard Cite

Abstract:The Antivirus (AV) products are utilized by home user's community to attain protection. To some extent, the AV meets users' expectations by detecting previously known malware samples. In this study, we question the set of events which should trigger the AV to scan data. Scanning every single piece of data as it moves from one location into another could be a demanding and performance-killing task. The AV faces a design challenge when deciding what kind of data to scan and when to do so. Typically, the on-access scanner component of the AV scans data upon moving from/to hard drives. Other occurrences of data movements are of equal importance. For example, data moves between different memory locations or between memory and network. In this study, we are motivated to explore what it needs to be done by the AV upon various data movements. We design and implement a system that has a capability of scanning memory when necessary. We recognize and intercept the most effective API calls that involve memory. Afterwards, we extract involved data and scan it if it has not been scanned before. We test our system against 15 real malware and find out that our system is capable of detecting all malware samples. Furthermore, we provide a thorough performance study to present the overhead of our system.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%