Detecting scareware by mining variable length instruction sequences

2011 Information Security for South Africa - Proceedings of the ISSA 2011 Conference

Volumn , Issue , 2011, Pages

  Shahzad, Raja Khurram ^a   Lavesson, Niklas ^a  

^a BLEKINGE INSTITUTE OF TECHNOLOGY   (Sweden)

Author keywords

Classification; Instruction Sequence; Scareware

Indexed keywords

ANTIVIRUS SOFTWARES; BINARY FILES; DATA MINING ALGORITHM; DATA SETS; DETECTION METHODS; INSTRUCTION SEQUENCE; MACHINE-LEARNING; MALICIOUS SOFTWARE; NOVICE USER; OP-CODE SEQUENCE; OTHER ALGORITHMS; RANDOM FOREST ALGORITHM; SCAREWARE; VARIABLE LENGTH;

BINARY SEQUENCES; DATA MINING; DECISION TREES; LEARNING ALGORITHMS; LEARNING SYSTEMS;

SECURITY OF DATA;

EID: 80053996934     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ISSA.2011.6027523     Document Type: Conference Paper

References (30)

1. Microsoft, "Rogue Security Software | Fake Virus Alerts | Scareware." [Online]. Available: http://www.microsoft.com/security/ antivirus/rogue.aspx. [Accessed: 12-Jan-2011].
2. G. Cluley, "Sizing Up The Malware Threat - Key Malware Trends for 2010," Network Security, vol. 2010, no. 4, pp. 8-10.
3. The Washington Post, "Security Fix - Massive Profits Fueling Rogue Antivirus Market." [Online]. Available: http://voices.washingtonpost.com/ securityfix/2009/03/obscene-profits-fuel-rogue-ant.html?wprss=securityfix. [Accessed: 13-Jan-2011].
4. Lavasoft AB, "Lavasoft." [Online]. Available: http://www.lavasoft.com/. [Accessed: 13-Jul-2010].
5. M. Cova, C. Leita, O. Thonnard, A. Keromytis, and M. Dacier, "An Analysis of Rogue AV Campaigns," in Recent Advances in Intrusion Detection, pp. 442-463.
6. M. A. Rajab, L. Ballard, P. Mavrommatis, N. Provos, and X. Zhao, "The Nocebo Effect on The Web: An Analysis of Fake Anti-virus Distribution," in Proceedings of the 3rd USENIX conference on Large-scale exploits and emergent threats: botnets, spyware, worms, and more (LEET 10), 2010, pp. 3-3.
7. J. Stewart, "Windows Messenger Popup Spam on UDP Port 1026."[Online]. Available: http://www.secureworks.com/research/threats/ popup-spam/. [Accessed: 19-Nov-2010].
8. L. Corrons, "The Business of Rogueware," Web Application Security, pp. 7-7, 2010.
9. Symantec Corporation, "Symantec Report on Rogue Security Software Press Kit." [Online]. Available: http://www.symantec.com/about/news/ resources/press-kits/detail.jsp?pkid=istr-rogue-security. [Accessed: 20-Jan-2011].
10. "Aftonbladet." [Online]. Available: http://www.aftonbladet.se/ nyheter/article13218796.ab. [Accessed: 24-Jun-2011].
11. "Swedish Windows Security User Group." [Online]. Available: http://winsec.se/?cat=166. [Accessed: 23-Jun-2011].
12. M. G. Schultz, E. Eskin, F. Zadok, and S. J. Stolfo, "Data Mining Methods for Detection of New Malicious Executables," in Proceedings of the IEEE Symposium on Security and Privacy (S&P 2001), pp. 38-49.
13. S. Dolev and N. Tzachar, "Malware Signature Builder and Detection for Executable Code," U.S. Patent EP2189920.
14. G. Salton, A. Wong, and C. S. Yang, "A Vector Space Model for Automatic Indexing," Communications of the ACM, vol. 18, pp. 613-620.
15. M. Simeon and R. Hilderman, "Categorical Proportional Difference: A Feature Selection Method for Text Categorization," in Proceedings of the Seventh Australasian Data Mining Conference (AusDM 2008), 2008, vol. 87, pp. 201-208.
16. I. H. Witten and E. Frank, Data Mining: Practical Machine Learning Tools and Techniques, 2nd ed. Morgan Kaufmann, 2005.
17. A. Sulaiman, K. Ramamoorthy, S. Mukkamala, and A. H. Sung, "Disassembled Code Analyzer for Malware (DCAM)," in Proceedings of the IEEE International Conference on Information Reuse and Integration (IRI-2005), 2005, pp. 398-403.
18. Jau-Hwang Wang, P. S. Deng, Yi-Shen Fan, Li-Jing Jaw, and Yu-Ching Liu, "Virus Detection using Data Mining Techinques," in Proceedings of IEEE 37th Annual 2003 International Carnahan Conference on Security Technology, 2003, pp. 71-76.
19. R. Moskovitch et al., "Unknown Malcode Detection using OPCODE Representation," in Proceedings of the 1st European Conference on Intelligence and Security Informatics (EuroISI 2008), 2008, pp. 204-215.
20. R. K. Shahzad, S. I. Haider, and N. Lavesson, "Detection of Spyware by Mining Executable Files," in Proceedings of the International Conference on Availability, Reliability, and Security (ARES 10), 2010, pp. 295-302.
21. CNET, "Free Software Downloads." [Online]. Available: http://download.cnet.com/. [Accessed: 02-Jan-2010].
22. F-Secure Corporation, "F-Secure - A Global IT Security & Antivirus Provider." [Online]. Available: http://www.f-secure.com/. [Accessed: 02-Oct-2010].
23. "The Netwide Assembler: NASM." [Online]. Available: http://www.nasm.us/. [Accessed: 13-Jul-2010].
24. W. W. Cohen, "Learning Trees and Rules with Set-valued Features,"in Proceedings of the Thirteenth National Conference on Artificial Intelligence, 1996, pp. 709-716.
25. J. R. Quinlan, C4.5: Programs for Machine Learning. Morgan Kaufmann Publishers Inc., 1993.
26. J. Platt, "Sequential Minimal Optimization: A Fast Algorithm for Training Support Vector Machines," Technical Report MST-TR-98-14. Microsoft Research, 1998.
27. C. Feng and D. Michie, "Machine Learning of Rules and Trees," in Machine learning, neural and statistical classification, Ellis Horwood, 1994, pp. 50-83.
28. T. Cover and P. Hart, "Nearest Neighbor Pattern Classification, "IEEE Transactions on Information Theory, vol. 13, no. 1, pp. 21-27, Jan. 1967.
29. L. Breiman, "Random Forests," Machine Learning, vol. 45, no. 1, pp. 5-32, Oct. 2001.
30. F. Provost, T. Fawcett, and R. Kohavi, "The Case Against Accuracy Estimation for Comparing Induction Algorithms," in Proceedings of the Fifteenth International Conference on Machine Learning (ICML 98), 1998, pp. 445-53.