標題: Three-phase behavior-based detection and classification of known and unknown malware
作者: Lin, Ying-Dar
Lai, Yuan-Cheng
Lu, Chun-Nan
Hsu, Peng-Kai
Lee, Chia-Yin
交大名義發表
資訊工程學系
National Chiao Tung University
Department of Computer Science
關鍵字: malware detection;malware classification;behavior analysis;sandbox;system call
公開日期: 25-Jul-2015
摘要: To improve both accuracy and efficiency in detecting known and even unknown malware, we propose a three-phase behavior-based malware detection and classification approach, with a faster detector in the first phase to filter most samples, a slower detector in the second phase to observe remaining ambiguous samples, and then a classifier in the third phase to recognize their malware type. The faster detector executes programs in a sandbox to extract representative behaviors fed into a trained artificial neural network to evaluate their maliciousness, whereas the slower detector extracts and matches the LCSs of system call sequences fed into a trained Bayesian model to calculate their maliciousness. In the third phase, we define malware behavior vectors and calculate the cosine similarity to classify the malware. The experimental results show that the hybrid two-phase detection scheme outperforms the one-phase schemes and achieves 3.6% in false negative and 6.8% in false positive. The third-phase classifier also distinguishes the known-type malware with an accuracy of 85.8%. Copyright (c) 2015 John Wiley & Sons, Ltd.
URI: http://dx.doi.org/10.1002/sec.1148
http://hdl.handle.net/11536/127857
ISSN: 1939-0114
DOI: 10.1002/sec.1148
期刊: SECURITY AND COMMUNICATION NETWORKS
Volume: 8
Issue: 11
起始頁: 2004
結束頁: 2015
Appears in Collections:Articles


Files in This Item:

  1. f237e4d0fcd7838ec038aefccbf81ea1.pdf