Combining file content and file relations for cloud based malware detection

Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining

Volumn , Issue , 2011, Pages 222-230

  Ye, Yanfang ^a   Li, Tao ^b   Zhu, Shenghuo ^c   Zhuang, Weiwei ^d   Tas, Egemen ^e   Gupta, Umesh ^e   Abdulhayoglu, Melih ^e  

^a Comodo Security Solutions ^*  (China)

^b Florida International University   (United States)

^c NEC LABORATORIES AMERICA   (United States)

^d XIAMEN UNIVERSITY   (China)

^e NONE   (United States)

Author keywords

Cloud based malware detection; File content; File relation; Semiparametric model for learning from graph

Indexed keywords

APPLICATION PROGRAMMING INTERFACES (API); COMPUTER VIRUSES; DAMAGE DETECTION;

ANTI-MALWARE; CLOUD BASED MALWARE DETECTION; CLOUD-BASED; FILE CONTENTS; FILE RELATION; INTERNET SECURITY; MALWARE DETECTION; MALWARES; SEMI-PARAMETRIC MODELING; SEMIPARAMETRIC MODEL FOR LEARNING FROM GRAPH;

DATA MINING;

EID: 80052681285     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2020408.2020448     Document Type: Conference Paper

References (31)

1. P. Beaucamps and E. Filiol. Metamorphism, formal grammars and undecidable code mutation. In Journal in Computer Science, 2 (1), pages 70-75, 2007.
2. P. Beaucamps and E. Filiol. On the possibility of practically obfuscating programs towards aunified perspective of code protection. In Journal in Computer Virology, 3 (1), 2007.
3. S. Chakrabarti, B. Dom, and P. Indyk. Enhanced hypertext categorization using hyperlinks. SIGMOD Rec., 27:307-318, June 1998. (Pubitemid 128655978)
4. M. Christodorescu, S. Jha, and C.Kruegel. Mining specifications of malicious behavior. In Proceedings of ESEC/FSE'07, pages 5-14, 2007.
5. D. Cohn and T. Hofmann. The missing link - a probabilistic model of document content and hypertext connectivity. In Advances in Neural Information Processing Systems 13, 2001.
6. D. Chau, C. Nachenberg, J. Willhelm, A. Wright and C. Faloutsos. Polonium: Tera-scale graph mining and inference for malware detection. In Proccedings of SIAM International Conference on Data Mining (SDM) 2011, 2011.
7. R. Fan, K. Chang, C. Hsieh, X. Wang, and C. Lin. Liblinear: A library for large linear classification. J. Mach. Learning Res., 9:1775-1778, 2008.
8. E. Filiol. Computer viruses: from theory to applications. In Springer, Heihelberg, 2005.
9. M. Fisher and R. Everson. When are links useful? experiments in text classification. In ECIR, 2003.
10. T. Joachims, N. Cristianini, and J. Shawe-Taylor. Composite kernels for hypertext categorisation. In ICML, 2001.
11. P. Kolari, T. Finin, and A. Joshi. Svms for the blogosphere: Blog identification and splog detection. In AAAI Spring Symposium on Computational Approaches to Analysing Weblogs, 2006.
12. A. Kolcz, X Sun, and J Kalita. Efficient handling of high-dimensional feature spaces by randomized classifier ensembles. In SIGKDD, 2002.
13. J. Kolter and M. Maloof. Learning to detect malicious executables in the wild. In SIGKDD, 2004.
14. A. Maguitman, F. Menczer, H. Roinestad, and A. Vespignani. Algorithmic detection of semantic similarity. In WWW, 2005.
15. M. Bailey, J. Oberheide, J. Andersen, Z. M.Mao, F. ahanian, and J. Nazario. Automated classification and analysis of internet malware. RAID 2007, LNCS, 4637:178-197, 2007.
16. H. Oh, S. Myaeng, and M. Lee. A practical hypertext catergorization method using links and incrementally available class information. In SIGIR, 2000.
17. J.R. Quinlan. C4.5. programs for machine learning. In San Mateo, CA: Morgan Kaufmann, 1993.
18. D. K. S. Reddy and A. K. Pujari. N-gram analysis for computer virus detection. J Comput Virol, pages 231-239, 2006. (Pubitemid 44777788)
19. M. Schultz, E. Eskin, and E. Zadok. Data mining methods for detection of new malicious executables. In Proccedings of 2001 IEEE Symposium on Security and Privacy, pages 38-49, 2001. (Pubitemid 32882625)
20. A. Sung, J. Xu, P. Chavez, and S. Mukkamala. Static analyzer of vicious executables (save). In Proceedings of the 20th Annual Computer Security Applications Conference, 2004.
21. G.J. Tesauro, J.O. Kephart, and G.B. Sorkin. Neural network for computer virus recognition. In IEEE Expert, 11:5-6), 1996.
22. I.W. Tsang, J.T. Kwok, and P.M. Cheung. Core vector machines: Fast svm training on very large data sets. J. Mach. Learn. Res., 6:363-392, 2005.
23. U. Bayer, A. Moser, C. Kruegel, and E. Kirda. Dynamic analysis of malicious code. J Comput Virol, 2:67-77, May 2006. (Pubitemid 44432022)
24. J. Wang, P. Deng, Y. Fan, L. Jaw, and Y. Liu. Virus detection using data mining techniques. In Proccedings of ICDM'03), 2003.
25. X. Jiang and X. Zhu. vEye: behavioral footprinting for self-propagating worm detection and profiling. Knowledge and Information System, 18(2):231-262, 2009.
26. Y. Yang, Seán Slattery, and R. Ghani. A study of approaches to hypertext categorization. J. Intell. Inf. Syst., 18:219-241, March 2002. (Pubitemid 34149560)
27. Y. Ye, D. Wang, T. Li, and D. Ye. IMDS: Intelligent malware detection system. In SIGKDD, 2007.
28. H. Yu, J. Yang, and J. Han. Classifying large data sets using svms with hierarchical clusters. In SIGKDD, 2003.
29. D. Zhou, O. Bousquet, T. N. Lal, J. Weston, and B. Scholkopf. Learning with local and global consistency. In Advances in Neural Information Processing Systems 16, 2004.
30. D. Zhou, S. Zhu, K. Yu, X. Song, B. L. Tseng, H. Zha, and C. Lee Giles. Learning multiple graphs for document recommendations. In WWW, 2008.
31. S. Zhu, K. Yu, Y. Chi, and Y. Gong. Combining content and link for classification using matrix factorization. In SIGIR, 2007.