Exploring the Effects of Gap-Penalties in Sequence-Alignment Approach to Polymorphic Virus Detection

Naidu, Vijay; Whalley, Jacqueline; Narayanan, Ajit

doi:10.4236/jis.2017.84020

Cited by 4 publications

(5 citation statements)

References 45 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…After conversion (Step-4), six discrete pairwise alignments (Step-5a) were first conducted (sequence 1 with sequence 2, sequence 3 with sequence 4, etc. [13]) was used during the processes of pairwise sequence alignment.…”

Section: Discussionmentioning

confidence: 99%

“…More details referring to the steps involved in this experiment can be found in the previous work [13] and Figure A1. Our method for Experiment I consists of six steps (see Figure A1).…”

Section: Conflicts Of Interestmentioning

confidence: 99%

“…Current signature extraction is by manual assessment using semantic information, by string-based syntactic approaches (see [10] [11] [12] [13] for more detail), or by a learning system that is, as yet, unknown. It has been recommended that learning sophisticated language classes, such as context-free or regular grammars, is not preferable from only positive inputs [14].…”

Section: Introductionmentioning

confidence: 99%

“…techniques based on analyzing the execution behavior of malware). The primary benefit with a syntactic or structural technique is that new and previously unknown variants can be generated from the extracted syntactic or structural rules of existing variants (see [13] for more detail). For a semantic approach, an actual variant instance is required so that it can be run to create an execution trace.…”

Section: Introductionmentioning

confidence: 99%

“…[11] [12] [13] were addressed. The learning task of maximizing true positive rates and minimizing false positive and false negative rates was satisfied.…”

mentioning

confidence: 99%

See 4 more Smart Citations

Generating Rule-Based Signatures for Detecting Polymorphic Variants Using Data Mining and Sequence Alignment Approaches

Naidu¹,

Whalley²,

Narayanan³

2018

JIS

Self Cite

View full text Add to dashboard Cite

Antiviral software systems (AVSs) have problems in detecting polymorphic variants of viruses without specific signatures for such variants. Previous alignment-based approaches for automatic signature extraction have shown how signatures can be generated from consensuses found in polymorphic variant code. Such sequence alignment approaches required variable length viral code to be extended through gap insertions into much longer equal length code for signature extraction through data mining of consensuses. Non-nested generalized exemplars (NNge) are used in this paper in an attempt to further improve the automatic detection of polymorphic variants. The important contribution of this paper is to compare a variable length data mining technique using viral source code to the previously used equal length data mining technique obtained through sequence alignment. This comparison was achieved by conducting three different experiments (i.e. Experiments I-III). Although Experiments I and II generated unique and effective syntactic signatures, Experiment III generated the most effective signatures with an average detection rate of over 93%. The implications are that future, syntactic-based smart AVSs may be able to generate effective signatures automatically from malware code by adopting data mining and alignment techniques to cover for both known and unknown polymorphic variants and without the need for semantic (run-time) analysis.

show abstract

Section: Discussionmentioning

confidence: 99%

“…More details referring to the steps involved in this experiment can be found in the previous work [13] and Figure A1. Our method for Experiment I consists of six steps (see Figure A1).…”

Section: Conflicts Of Interestmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…[11] [12] [13] were addressed. The learning task of maximizing true positive rates and minimizing false positive and false negative rates was satisfied.…”

mentioning

confidence: 99%

See 3 more Smart Citations