Malware detection based on mining API calls

Proceedings of the ACM Symposium on Applied Computing

Volumn , Issue , 2010, Pages 1020-1025

  Sami, Ashkan ^a   Yadegari, Babak ^a   Rahimi, Hossein ^a   Peiravian, Naser ^a   Hashemi, Sattar ^a   Hamze, Ali ^a  

^a SHIRAZ UNIVERSITY   (Iran)

Author keywords

API call; frequent pattern mining; malware detection; polymorphic metamorphic malware; portable executable (PE); public dataset

Indexed keywords

DATA SETS; FREQUENT PATTERN MINING; MALWARE DETECTION; MALWARES; PORTABLE EXECUTABLE;

APPLICATION PROGRAMMING INTERFACES (API); DATA PROCESSING; LOSSES; SECURITY OF DATA;

COMPUTER CRIME;

EID: 77954707625     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1774088.1774303     Document Type: Conference Paper

References (27)

1. Malicious software (malware): A security threat to the internet economy. Technical report, Organization For Economic Co-operation And Development, 2007.
2. G. Batista, R. Prati, and M. Monard. A study of the behavior of several methods for balancing machine learning training data. ACM SIGKDD Explorations Newsletter, 2004.
3. L. Breiman and A. Culter. Random forests. Machine Learning, 2001.
4. M. Christodorescu and S. Jha. Static analysis of executables to detect malicious patterns. In Proceedings of the 12th USENIX Security Symposium, 2003.
5. R. Duda, P. Hart, and D. Stork. Pattern Classification. Wiley Interscience, 2nd edition, 2000.
6. J. Han. Illimine project. University of Illinois at Urbana-Champaign Database and Information Systems Laboratory, 2005.
7. J. Han and M. Kamber. Data Mining: Concepts and Techniques. DataManagement Systems. Morgan Kaufmann, 2nd edition, 2006.
8. J. Han, J. Pei, Y. Yin, and R. Mao. Mining frequent patterns without candidate generation. Springer, 2004.
9. S. Hashemi, Y. Yang, D. Zabihzadeh, and M. Kangavari. Detecting intrusion transactions in databases using data item dependencies and anomaly analysis. Expert Systems, 25(5), November 2008.
10. V. Heavens. http://vx.netlux.org.
11. J. Kephart and W. Arnold. Automatic extraction of computer virus signatures. In Proceedings of 4th Virus Bulletin International Conference, pages 178-184, 1994.
12. J. Kolter and M. Maloof. Learning to detect malicious executables in the wild. In Proceedings of KDD'04, 2004.
13. T. Lee and J. Mody. Behavioral classification. In Proceedings of 2006 EICAR Conference, 2006.
14. M. D. Library. Functions by category (windows). http://msdn.microsoft. com/enus/library/aa383686(VS.85).aspx.
15. D. Lo, H. Cheng, J. Han, S. Khoo, and C. Sun. Classification of software behaviors for failure detection: A discriminative pattern mining approach. In Conference on Knowledge discovery and data mining. ACM SIG-KDD, 2009.
16. R. Loand, K. Levitt, and R. Olsson. A malicious code filter. In Comput. Secur., pages 541-566, 1995.
17. H. Peng, F. Long, and C. Ding. Feature selection based on mutual information: Criteria of max-dependency, max-relevance, and min-redundancy. IEEE Trans. Pattern Anal. Mach. Intell., 27, 2005.
18. M. Pietrek. Peering Inside the PE: A Tour of the Win32 Portable Executable File Format. Microsoft, http://msdn.microsoft.com/enus/magazine/ ms809762.aspx, February 1994.
19. M. Pietrek. An In-Depth Look into the Win32 Portable Executable File Format. Microsoft, http://msdn.microsoft.com/enus/magazine/cc301805.aspx, February 2002.
20. J. Rabek, R. Khazan, S. Lewandowski, and R. Cunningham. Detection of injected, dynamically generated, and obfuscated malicious code. In Proceedings of the 2003 ACM Workshop on Rapid Malcode, pages 76-82, 2003.
21. M. Schultz, E. Eskin, and E. Zadok. Data mining methods for detection of new malicious executables. In Security and Privacy Proceedings IEEE Symposium, pages 38-49, May 2001.
22. A. Sung, J. Xu, P. Chavez, and S. Mukkamala. Static analyzer of vicious executables (save). In Proceedings of the 20th Annual Computer Security Applications Conference, 2004.
23. Symantec. Symantec internet security threat report: Trends for july-december 2007 (executive summary). Technical report, Symantec Corp, April 2008.
24. J. Wang, P. Deng, Y. Fan, L. Jaw, and Y. Liu. Virus detection using data mining techniques. In Proceedings of IEEE International Conference on Data Mining, 2003.
25. H. Witten and E. Frank. Data Mining: Practical machine learning tools and techniques. Morgan Kaufmann, 2nd edition, 2005.
26. X. Yan, J. Han, and R. Afshar. Clospan: Mining closed sequential patterns in large datasets. Proceedings of 3rd SIAM International Conference on Data Mining (SDM'03), May 2003.
27. Y. Ye, D. Wang, T. Li, and D. Ye. An intelligent pe-malware detection system based on association mining. In Journal in Computer Virology, 2008.