Study of an Approach Based on the Analysis of Computer Program Execution Traces for the Detection of Vulnerabilities

Koala, Gouayon; Bassolé, Didier; Tiendrébéogo, Télesphore; Sié, Oumarou

doi:10.1007/978-3-031-23116-2_8

Cited by 1 publication

(3 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It is therefore crucial and urgent to find effective solutions to protect data. Several methods and techniques based on static and dynamic approaches are proposed [7], [19], [13], [16]. Previous works [4], [19], [16] have proposed literature reviews on both analysis approaches and their weaknesses [3], [17], on analysis techniques, [7], [20], on the use of machine learning techniques [7], [8], [17], on digital traces [11], [16].…”

Section: Related Workmentioning

confidence: 99%

“…Several methods and techniques based on static and dynamic approaches are proposed [7], [19], [13], [16]. Previous works [4], [19], [16] have proposed literature reviews on both analysis approaches and their weaknesses [3], [17], on analysis techniques, [7], [20], on the use of machine learning techniques [7], [8], [17], on digital traces [11], [16]. Nevertheless, we will mention some of the work related to traces, especially as our approach is a hybrid one.…”

Section: Related Workmentioning

confidence: 99%

“…Instead, they are typically employed for debugging, profiling, or logging purposes. This study aims to assess the hypothesis that traces of application execution are high-quality data that can be used to analyze and detect malicious applications [16]. Consequently, the solution proposed in this study is founded on capturing relevant behavioral elements (events) during application execution, based on pertinent characteristics.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Software Vulnerabilities’ Detection by Analysing Application Execution Traces

Koala,

Bassol´e,

Tiendrebeogo

et al. 2023

IJACSA

View full text Add to dashboard Cite

Over the years, digital traces have proven to be significant for analyzing IT systems, including applications. With the persistent threats arising from the widespread proliferation of malware and the evasive techniques employed by cybercriminals, researchers and application vendors alike are concerned about finding effective solutions. In this article, we assess a hybrid approach to detecting software vulnerabilities based on analyzing traces of application execution. To accomplish this, we initially extract permissions and features from manifest files. Subsequently, we employ a tracer to extract events from each running application, utilizing a set of elements that indicate the behavior of the application. These events are then recorded in a trace. We convert these traces into features that can be utilized by machine learning algorithms. Finally, to identify vulnerable applications, we train these features using six machine learning algorithms (KNN, Random Forest, SVM, Naive Bayes, Decision Tree-CART, and MLP). The selection of these algorithms is based on the outcomes of several preliminary experiments. Our results indicate that the SVM algorithm produces the best performance, followed by Random Forest, achieving an accuracy of 98% for malware detection and 96% for benign applications. These findings demonstrate the relevance and utility of analyzing real application behavior through event analysis.

show abstract