Comparing files using structural entropy

Journal in Computer Virology

Volumn 7, Issue 4, 2011, Pages 259-265

  Sorokin, Ivan ^a  

^a Doctor Web's Virus Lab Ltd   (Russian Federation)

Author keywords

[No Author keywords available]

Indexed keywords

ANTI VIRUS; ANTIVIRUS SOFTWARES; EDIT DISTANCE; EXECUTABLE CODES; FALSE ALARMS; FILE SCANNING; FILE STORAGE; ITS DATA; MALWARES; STRUCTURAL ENTROPY;

ALGORITHMS; COMPUTER CRIME; ENTROPY; PERSONAL COMPUTERS; WAVELET ANALYSIS;

STATIC ANALYSIS;

EID: 80255131297     PISSN: 17729890     EISSN: 17729904     Source Type: Journal    
DOI: 10.1007/s11416-011-0153-9     Document Type: Article

References (17)

1. Breitenbacher, Z.: Entropy based detection of polymorphic malware. In: Proceedings of the 19th Annual EICAR Conference "ICT Security: Quo Vadis?", pp. 117-128. Presses Techniques de l'ESIEA, Paris (2010).
2. Daubechies, I.: Desjat' lektsij po vejvletam. [Ten lectures on wavelets]. Izhevsk: NIC Regular and Chaotic Dynamics (2001).
3. Ebringer, R., Sun, L., Boztas, S.: A fast randomness test that preserves local detail. In: Proceedings of the Virus Bulletin (VB) Conference, pp. 34-42. Virus Bulletin, Abingdon (2008).
4. Fabjanski K., Kruk T.: Network traffic classification by common subsequence finding. In: Bubak, M., Albada, G., Sloot, P. (eds) Computational Science-ICCS 2008, vol. 5101, pp. 499-508. Springer, Berlin (2008).
5. Gheorghescu, M.: An automated virus classification system. In: Proceedings of the Virus Bulletin (VB) Conference, pp. 294-300. Virus Bulletin, Abingdon (2005).
6. Kreibich, C., Crowcroft, J.: Efficient sequence alignment of network traffic. In: Proceedings of Internet Measurement Conference, pp. 307-312. IMC, Melbourne (2006).
7. Li, J., Xu, J., Xu, M., Zhao, H., Zheng, N.: Malware obfuscation measuring via evolutionary similarity. In: Proceedings of the International Conference on Future Information Networks, pp. 197-200. IEEE Computer Society, Los Alamitos (2009).
8. Lyda R., Hamrock J.: Using entropy analysis to find encrypted and packed malware. IEEE Security Priv. 5(2), 40-45 (2007).
9. Newsome, J., Karp, B., Song, D.: Polygraph: Automatically generating signatures for polymorphic worms. In: Proceedings of the 2005 IEEE Symposium on Security and Privacy, pp. 226-241. IEEE Computer Society, Los Alamitos (2005).
10. Perdisci R., Lanzi A., Lee W.: Classification of packed executables for accurate computer virus detection. Pattern Recognit. Lett. 29(14), 1941-1946 (2008).
11. Sun, L., Versteeg, S., Boztas, S., Yann, T.: Pattern recognition techniques for the classification of malware packers. In: Proceedings of the 15th Australian Conference on Information Security and Privacy (pp. 370-390). Springer, Berlin (2010).
12. Sung, A. H., Xu, J., Chavez, P., Mukkamala, S.: Static analyzer of vicious executables (SAVE). In: Proceedings of the 20th Annual Computer Security Applications Conference, pp. 326-334. IEEE Computer Society, Washington (2004).
13. Wagener G., State R., Dulaunoy A.: Malware behaviour analysis, extended version. J. Comput. Virol. 4(4), 279-287 (2007).
14. Christodorescu, M., Jha, S.: Testing malware detectors. In: Proceedings of the ACM SIGSOFT International Symposium on Software Testing and Analysis, pp. 34-44. ACM, New York (2004).
15. Jacob, G., Neugschwandtner, M., Comparetti, P. M., Kruegel, C., Vigna, G.: A static, packer-agnostic filter to detect similar malware samples. Department of Computer Science University of California Santa Barbara Technical Report, 2010-26. Retrieved 29 November 2010 from http://www. cs. ucsb. edu/research/tech_reports/ (2010).
16. Wagner R. A., Fischer M. J.: The string-to-string correction problem. J. ACM 21(1), 168-173 (1974).
17. Prangišvili, I. V.: Èntropijnye i drugie sistemnye zakonomernosti. Voprosy upravlenija složnymi sistemami (Entropy and other system laws. Issues of managing complex systems). p. 432. Nauka, Moscow (2003).