McBoost: Boosting scalability in malware collection and analysis using statistical classification of executables

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn , Issue , 2008, Pages 301-310

  Perdisci, Roberto ^a,c   Lanzi, Andrea ^b,c   Lee, Wenke ^a,c  

^a Damballa Inc   (United States)

^b UNIVERSITY OF MILAN   (Italy)

^c Georgia Institute of Technology   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CLASSIFIERS; CODES (SYMBOLS); COMPUTER CRIME; LEARNING SYSTEMS; SCALABILITY; SECURITY OF DATA; SECURITY SYSTEMS;

ANALYSIS APPROACHES; AREA UNDER THE ROC CURVES; BINARY ANALYSIS; COMPUTATION TIME; EXECUTABLES; MALWARE; MALWARE DETECTIONS; ON DYNAMICS; PROOF OF CONCEPTS; SIGNATURE EXTRACTIONS; STATISTICAL CLASSIFICATIONS;

DYNAMIC ANALYSIS;

EID: 60649088451     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ACSAC.2008.22     Document Type: Conference Paper

References (26)

1. F. Bellard. Qemu, a fast and portable dynamic translator. In USENIX Annual Technical Conference, 2005.
2. D. Bilar. Opcode as predictors for malware. International Journal of Electronic Security and Digital Forensics, 1(2), 2007.
3. L. Breiman. Bagging predictors. Machine Learning, 24(2):123-140, 1996.
4. T. Brosch and M. Morgenstern. Runtime packers: The hidden problem? Presented at Black Hat USA 2006.
5. C. Cortes and M. Mohri. Confidence intervals for the area under the roc curve. In NIPS 2004: Advances in Neural Information Processing Systems, 2004.
6. R. Duin. The combining classifier: to train or not to train? In International Conference on Pattern Recognition (ICPR), 2002.
7. A. Kalafut, A. Acharya, and M. Gupta. A study of malware in peer-to-peer networks. In ACM SIGCOMM conference on Internet measurement, 2006.
8. M. G. Kang, P. Poosankam, and H. Yin. Renovo: A hidden code extractor for packed executables. In WORM '07: Proceedings of the 5th ACM Workshop on Recurring Malcode, 2007.
9. J. Z. Kolter and M. A. Maloof. Learning to detect and classify malicious executables in the wild. Journal of Machine Learning Research, 7:2721-2744, 2006.
10. L. I. Kuncheva. Combining Pattern Classifiers: Methods and Algorithms. Wiley-Interscience, 2004.
11. A. Niculescu-Mizil and R. Caruana. Predicting good probabilities with supervised learning. In International Conference on Machine Learning (ICML), 2005.
12. R. Perdisci, G. Gu, and W. Lee. Using an ensemble of one-class svm classifiers to harden payload-based anomaly detection systems. In International Conference on Data Mining (ICDM), 2006.
13. R. Perdisci, A. Lanzi, and W. Lee. Classification of packed executables for accurate computer virus detection. Patter Recognition Letters, 29(14):1941-1946, 2008.
14. M. B. Prince, L. Holloway, E. Langheinrich, B. M. Dahl, and A. M. Keller. Understanding how spammers steal your e-mail address: An analysis of the first six months of data from project honey pot. In 2nd Conference on Email and Anti-Spam (CEAS), 2005.
15. D. K. S. Reddy and A. K. Pujari. N-gram analysis for computer virus detection. Journal in Computer Virology, 2(3), 2006.
16. P. Royal, M. Halpin, D. Dagon, R. Edmonds, and W. Lee. Polyunpack: Automating the hidden-code extraction of unpack-executing malware. In Annual Computer Security Applications Conference (ACSAC), 2006.
17. M. G. Schultz, E. Eskin, E. Zadok, and S. J. Stolfo. Data mining methods for detection of new malicious executables. In IEEE Symposium on Security and Privacy, 2001.
18. A. Shevchenko. The evolution of self-defense technologies in malware, 2007. http://www.viruslist.com/analysis?pubid=204791949.
19. S. Shin, J. Jung, and H. Balakrishnan. Malware prevalence in the kazaa file-sharing network. In ACM SIGCOMM Conference on Internet measurement, 2006.
20. A. Stepan. Improving proactive detection of packed malware, March 2006. http://www.virusbtn.com/virusbulletin/archive/2006/03/vb200603-packed.dkb.
21. Y. Wang, D. Beck, X. Jiang, R. Roussev, C. Verbowski, S. Chen, and S. T. King. Automated web patrol with strider honeymonkeys: Finding web sites that exploit browser vulnerabilities. In NDSS, 2006.
22. T. Werner. PE Hunter, 2007. http://honeytrap.mwcollect.org/pehunter.
23. Y. Yang and J. O. Pedersen. A comparative study on feature selection in text categorization. In International Conference on Machine Learning (ICML), 1997.
24. H. Yin, D. Song, M. Egele, C. Kruegel, and E. Kirda. Panorama: capturing system-wide information flow for malware detection and analysis. In CCS '07: 14th ACM conference on Computer and communications security, 2007.
25. B. Zhang, J. Yin, J. Hao, D. Zhang, and S. Wang. Malicious codes detection based on ensemble learning. In Autonomic and Trusted Computing (ATC), 2007.
26. J. Zhuge, T. Holz, X. Han, C. Song, and W. Zou. Collecting autonomous spreading malware using high-interaction honeypots. In ICICS 2007, 2007.