Classification of packed executables for accurate computer virus detection

Pattern Recognition Letters

Volumn 29, Issue 14, 2008, Pages 1941-1946

  Perdisci, Roberto ^a   Lanzi, Andrea ^b,c   Lee, Wenke ^a,b  

^a Damballa Inc   (United States)

^b GEORGIA INSTITUTE OF TECHNOLOGY   (United States)

^c UNIVERSITY OF MILAN   (Italy)

Author keywords

Computer security; Computer virus detection; Packed executables; Pattern recognition

Indexed keywords

CODES (STANDARDS); CODES (SYMBOLS); COMPUTER CRIME; COMPUTER SOFTWARE; FEATURE EXTRACTION; PATTERN RECOGNITION; VIRUSES;

ANTI-VIRUS SOFTWARE; COMPUTATIONALLY EXPENSIVE; COMPUTER SECURITY; COMPUTER VIRUS DETECTION; DETECTION ACCURACY; EXECUTABLES; MALICIOUS CODE; PACKED EXECUTABLES; PATTERN RECOGNITION TECHNIQUES; PROCESSING TIME; VIRUS WRITERS;

COMPUTER VIRUSES;

EID: 50149118846     PISSN: 01678655     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.patrec.2008.06.016     Document Type: Article

References (16)

1. Andersen, S., 2004. Changes to Functionality in Microsoft Windows XP Service Pack 2, Part 3: Memory Protection Technologies. .
2. CA. Win32.sdbot Family (2005). .
3. CA. Win32.agobot Family (2006). .
4. Cohen F. Computer viruses: theory and experiments. Comput. Security 6 1 (1987) 22-35
5. Cortes, C., Mohri, M., 2004. Confidence intervals for the area under the roc curve. In: NIPS 2004: Advances in Neural Information Processing Systems.
6. Kang, M.G., Poosankam, P., Yin, H., 2007. Renovo: A hidden code extractor for packed executables. In: WORM'07: Proceedings of the 5th ACM Workshop on Recurring Malcode.
7. Kolter J.Z., and Maloof M.A. Learning to detect and classify malicious executables in the wild. J. Mach. Learn. Res. 7 (2006) 2721-2744
8. Lyda R., and Hamrock J. Using entropy analysis to find encrypted and packed malware. IEEE Security Privacy 5 2 (2007) 40-45
9. Martignoni, L., Christodorescu, M., Jha, S., 2007. Omniunpack: fast, generic, and safe unpacking of malware. In: ACSAC'07: Proceedings of the 23rd Annual Computer Security Applications Conference on Annual Computer Security Applications Conference.
10. Morgenstern, M., Brosch, T., 2006. Runtime Packers: The Hidden Problem? Presented at Black Hat USA 2006.
11. Perdisci, R., Gu, G., Lee, W., 2006. Using an ensemble of one-class SVM classifiers to harden payload-based anomaly detection systems. In: ICDM'06: Proceedings of the Sixth International Conference on Data Mining.
12. Pietrek, M., 2002a. An In-depth Look into the Win32 Portable Executable File Format. .
13. Pietrek, M., 2002b. An In-depth Look into the Win32 Portable Executable File Format, part 2. .
14. Royal, P., Halpin, M., Dagon, D., Edmonds, R., Lee, W., 2006. Polyunpack: automating the hidden-code extraction of unpack-executing malware. In: ACSAC'06: Proceedings of the 22nd Annual Computer Security Applications Conference on Annual Computer Security Applications Conference.
15. Stepan, A., 2006 Improving Proactive Detection of Packed Malware. .
16. Wright C.V., Monrose F., and Masson G.M. On inferring application protocol behaviors in encrypted network traffic. J. Mach. Learn. Res. 7 (2006) 2745-2769