N-Grams-Based File Signatures for Malware Detection

Abstract

Malware is any malicious code that has the potential to harm any computer or network. The amount of malware is increasing faster every year and poses a serious security threat. Thus, malware detection is a critical topic in computer security. Currently, signature-based detection is the most extended method for detecting malware. Although this method is still used on most popular commercial computer antivirus software, it can only achieve detection once the virus has already caused damage and it is registered. Therefore, it fails to detect new malware. Applying a methodology proven successful in similar problem-domains, we propose the use of ngrams (every substring of a larger string, of a fixed lenght n) as file signatures in order to detect unknown malware whilst keeping low false positive ratio. We show that n-grams signatures provide an effective way to detect unknown malware.

Empirical assessment of machine learning-based malware detectors for Android

“…Already in 1994, Kephart at IBM has proposed to use N-grams for malware analysis (Kephart 1994). More recently a large body of research in malware detection based on machine learning have opted for n-grams to generate file/program signatures for the training dataset of malware (Henchiri and Japkowicz 2006;Kolter and Maloof 2006;Santos et al 2009). Despite the high performance claimed by the authors for very small datasets, between 500 and 3 000 software programs, we believe that a malware detector based on n-grams, because of its vulnerability to obfuscation, could be trivially defeated by malware authors.…”

Using opcode-sequences to detect malicious Android applications

“…Google reacted in setting up Google Bouncer, which scans applications before submission. However, according to a Karspersky security bulletin 4 , no significant change has been observed. Researchers [1] have found ways to bypass the Google Bouncer in fingerprinting the Android emulator used by the service.…”

“…Known feature sets that have already been used in the past to detect malicious programs: n-grams [4], opcodes [5], Android permissions combined with Control Flow Graphs [6] and several others. Finding the feature set that generalizes the most our observable is the most challenging task.…”

Effectiveness of Opcode ngrams for Detection of Multi Family Android Malware

“…Santos et al [35] propose opcode ngrams to detect malware using a dataset composed by 1000 malware and 1000 trusted computer applications. They conclude that using 2gram the detection ratio is quite low, achieving a maximum value of 69.66%, thus 2-grams do not seem to be appropriate for malware detection.…”