Detecting a malicious executable without prior knowledge of its patterns

Proceedings of SPIE - The International Society for Optical Engineering

Volumn 5812, Issue , 2005, Pages 1-12

  Cai, D Michael ^a   Theiler, James ^a   Gokhale, Maya ^a  

^a LOS ALAMOS NATIONAL LABORATORY   (United States)

Author keywords

Email Filtering; Malicious Executable File; Mining high dimensional data; One class Support Vector Machine; Principal Component Analysis

Indexed keywords

EMAIL FILTERING; MALICIOUS EXECUTABLE FILES; MINING HIGH-DIMENSIONAL DATA; ONE-CLASS SUPPORT VECTOR MACHINES;

COMPUTER VIRUSES; DATA MINING; ELECTRONIC MAIL; FEATURE EXTRACTION; LEARNING SYSTEMS; MATHEMATICAL MODELS; PRINCIPAL COMPONENT ANALYSIS; PROBABILITY;

ALGORITHMS;

EID: 27544499740     PISSN: 0277786X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1117/12.603174     Document Type: Conference Paper

References (24)

1. V. Barnett and T. Lewis, Outliers in Statistical Data, (John Wiley & Sons Ltd, 1978).
2. C. Bishop, Neural Networks for Pattern Recognition, (Oxford University Press, Oxford, 1995).
3. D. M. Cai, M. Gokhale and J. Theiler, Comparison of Feature Selection and Classification Algorithms in Identifying Malicious Executables, Submitted to Data and Knowledge Engineering 2003.
4. C. C Chang and C.J. Lin, LIBSVM: a Library for Support Vector Machines, Software available at http://www.csie.ntu.edu.tw/~cjlin/libsvm/. 2001.
5. F. Cohen, A Cryptographic Checksum for Integrity Protection, Computers and Security 6 (1987) 505-510.
6. C. Cortes and V. Vapnik, Support Vector Network, Machine Learning 20 (1995) 273-297.
7. R. Crawford, R. Lo, J. Crossley, G. Fink, P. Kerchen, W. Ho, K. Levitt, R. Olsson, and M. Archer, A Testbed for Malicious Code Detection: A Synthesis of Static and Dynamic Analysis Techniques, Proceedings of the Department of Energy Computer Security Group Conference, 17, pp. 1-23, 1991.
8. S. Crocker and M. M. Pozzo, A Proposal for a Verification to Malicious Code Detection, Proceedings of IEEE Computer Soc. Symposium on Security and Privacy, pp. 319-324, 1989.
9. E. Eskin, A. Arnold, M. Prerau, L. Portnoy, S. Stolfo, A geometric framework for unsupervised anomaly detection: detecting intrusions in Unlabeled Data. On Application of Data Mining in Computer Security, Edited by D. Barbará and S. Jajodia, (Kluwer Academic Publisher, 2002).
10. S. Forrest, S. A. Hofmeyr, and A. Somayaji. Computer Immunology, Communications of the ACM, pp. 88-9, 1997.
11. J. E. Jackson, A User's Guide to Principal Components, (John Wiley and Sons, 1991).
12. th Virus Bulletin International Conference, pp. 178-184, 1994.
13. R. W. Lo, P. Kerchen, R. Crawford, W. Ho, J. Crossley, G. Fink, K. Levitt, R. Olsson, and M. Archer, Towards for Malicious Code Detection, IEEE Computer Society International Conference, pp. 160-166, 1991.
14. R. W. Lo, Karl N. Levvit, and Ronald A. Olsson, MCF: A Malicious Code Filter, Computers & Security, 14, pp. 541-566, 1995.
15. MathWorks, Statistical Toolbox for User's Guide, MathWorks, 2001.
16. S. Roberts, L. Tarassenko, J. Pardey, and D. Siegwart, A validation index for artificial neural network, In Proceedings of Int. Conference on Neural Networks and Expert System in Medicine and Healthcare, pp. 23-30, 1994.
17. B. Schölkopf, J. C. Platt, J. Shawe-Taylor, A. J. Smola, and R. C. Williamson, Estimating the support of high-dimensional distribution, Neural Computation (13), pp. 1443-1471, 2001.
18. M. G. Schultz, E. Eskin, E. Zadok, and S. J. Stolfo, Data Mining Methods for Detection of New Malicious Executables, Proceedings of IEEE Symposium on Security and Privacy. Oakland, pp.38-49, 2001.
19. M. G. Schultz, E. Eskin, and S. J. Stolfo, Malicious Email Filter - A UNIX Mail Filter that Detects Malicious Windows Executables, Proceedings of USENIX Annual Technical Conference - FREENIX Track. Boston, MA: June, 2001.
20. D. Tax and R. Duin, Data domain description by support vectors, in Proc. ESANN, M. Vefieysen, Ed., Brussels, pp. 251-256, D. Facto Press, 1999.
21. D. M. J. Tax, One-class classification: concept-learning in the absence of counter-examples, Doctorate Dissertation, TU Delft, 2001.
22. D.M.J. Tax and P. Juszczak. Kernel whitening for data description, International Workshop on Pattern Recognition with Support Vector Machines 2002, Niagara Falls, Canada.
23. G. Tesauro, J. O. Kephart, and G. B. Sorkin, Neural Networks for Computer Virus Recognition, IEEE Expert, 11 (1996) 5-6.
24. V. Vapnik, Statistical Learning Theory, (New York, John Wiley & Sons, Inc., 1998).