SBE − A Precise Shellcode Detection Engine Based on Emulation and Support Vector Machine

Abstract-A zero-day attack poses a serious threat to the Internet security as it exploits zero-day vulnerabilities in the computer systems. Attackers take advantage of the unknown nature of zero-day exploits and use them in conjunction with highly sophisticated and targeted attacks to achieve stealthiness with respect to standard intrusion detection techniques. Thus, it's difficult to defend against such attacks. Present research exhibits various issues and is not able to provide complete solution for the detection and analysis of zero-day attacks. This paper presents a novel hybrid system that integrates anomaly, behavior and signature based techniques for detecting and analyzing zero-day attacks in real-time. It has layered and modular design which helps to achieve high performance, flexibility and scalability. The system is implemented and evaluated against various standard metrics like True Positive Rate (TPR), False Positive Rate (FPR), FMeasure, Total Accuracy (ACC) and Receiver Operating Characteristic (ROC) curve. The result shows high detection rate with nearly zero false positives. Additionally, the proposed system is compared with Honeynet system.

show abstract

“…SBE [32] is a shellcode detection technique based on emulation and Support Vector Machine. It comprises of two stages: train and classification.…”

Section: Related Workmentioning

confidence: 99%

A Hybrid Real-time Zero-day Attack Detection and Analysis System

Kaur

Singh²

2015

IJCNIS

View full text Add to dashboard Cite

show abstract

“…To defend against zero-day malware there has been a shift from signature-based [5][6][7][8]38] to anomaly-based detection [9] and behavioral-based detection [10][11][12][13][14][15][16]39]. Various behavior-based detection techniques have been proposed that understands the behavior of zero-day malware through dynamic execution [10,11].…”

Section: Introductionmentioning

confidence: 99%

Hybrid Real-time Zero-day Malware Analysis and Reporting System

Kaur

Singh

2016

IJITCS

View full text Add to dashboard Cite

Abstract-To understand completely the malicious intents of a zero-day malware there is really no automated way. There is no single best approach for malware analysis so it demands to combine existing static, dynamic and manual malware analysis techniques in a single unit. In this paper a hybrid real-time analysis and reporting system is presented. The proposed system integrates various malware analysis tools and utilities in a component-based architecture. The system automatically provides detail result about zero-day malware's behavior. The ultimate goal of this analysis and reporting is to gain a quick and brief understanding of the malicious activity performed by a zero-day malware while minimizing the time frame between the detection of zero-day attack and generation of a security solution. The results are paramount valuable for a malware analyst to perform zero-day malware detection and containment.

show abstract