Mining specifications of malicious behavior

Abstract

Malware detectors require a specification of malicious behavior. Typically, these specifications are manually constructed by investigating known malware. We present an automatic technique to overcome this laborious manual process. Our technique derives such a specification by comparing the execution behavior of a known malware against the execution behaviors of a set of benign programs. In other words, we mine the malicious behavior present in a known malware that is not present in a set of benign programs. The output of our algorithm can be used by malware detectors to detect malware variants. Since our algorithm provides a succinct description of malicious behavior present in a malware, it can also be used by security analysts for understanding the malware. We have implemented a prototype based on our algorithm and tested it on several malware programs. Experimental results obtained from our prototype indicate that our algorithm is effective in extracting malicious behaviors that can be used to detect malware variants.

NewApproach for Detecting Unknown Malicious Executables

“…We acquired the malicious files from the VX Heaven website [17]. The files in the benign set, including executable and DLL (Dynamic Linked Library) files, were gathered from machines running Windows XP operating system in our campus.…”

Web based Malware Detection using Important Supervised Learning Techniques on Online Web Traffic

“…The reasons of growing web based malware in web world are to increase cyber crimes. The real world applications mostly effected from malware are banking, electronics communication and online shopping etc [1].…”

Implementing rootkits to address operating system vulnerabilities

“…The reason for not being able to achieve a 100% detection and / or prevention of malware is because malware authors make use of sophisticated hiding techniques in order to prevent malware from being detected by means of signature based techniques. Such techniques are either entirely or partially based on code obfuscation [5][2] [6]. This has resulted in the emergence of malware known as polymorphic and metamorphic malware.…”