Malware target recognition via static heuristics

Computers and Security

Volumn 31, Issue 1, 2012, Pages 137-147

  Dube, T ^a   Raines, R ^a   Peterson, G ^a   Bauer, K ^a   Grimaila, M ^a   Rogers, S ^b  

^a AIR FORCE INSTITUTE OF TECHNOLOGY   (United States)

^b AIR FORCE RESEARCH LABORATORY   (United States)

Author keywords

Intrusion detection; Machine learning; Malware; Malware detection; Situation awareness

Indexed keywords

ANTI VIRUS; BUSINESS OPERATION; COMPETITIVE EDGES; CYBERSPACES; DATA SETS; DETECTION RATES; FALSE NEGATIVE RATE; FALSE POSITIVE; FINE GRANULARITY; HIGH COSTS; INFORMATION AND COMMUNICATIONS TECHNOLOGY; MACHINE-LEARNING; MALWARE DETECTION; MALWARES; PERFORMANCE CURVE; SITUATION AWARENESS; TARGET RECOGNITION; TREE MACHINES;

DECISION TREES; FEATURE EXTRACTION; INTRUSION DETECTION; LEARNING ALGORITHMS; LEARNING SYSTEMS; TREES (MATHEMATICS);

COMPUTER CRIME;

EID: 84856006502     PISSN: 01674048     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.cose.2011.09.002     Document Type: Conference Paper

References (34)

1. T. Abou-Assaleh, N. Cercone, V. Keselj, and R. Sweidan N-gram-based detection of new malicious code Proceedings of the 28th annual international computer software and applications conference 2004 IEEE New York, USA 41 42 (Pubitemid 40680776)
2. W. Arnold, and G. Tesauro Automatically Generated Win32 heuristic virus detection, VIRUS 51 2000
3. M. Bailey, J. Oberheide, J. Andersen, and Z. Mao Automated classification and analysis of Internet malware Proceedings of the 10th International Symposium on Recent Advances in intrusion detection 2007 Springer 178 197
4. V. Bontchev Current status of the caro malware naming scheme 2005 URL: (accessed 15.09.09)
5. L. Cavallaro, P. Saxena, and R. Sekar On the limits of information flow techniques for malware analysis and containment Proceedings of the 5th international conference on detection of intrusions and malware, and vulnerability assessment 2008 Springer-Verlag 143 163
6. M. Christodorescu, S. Jha, and C. Kruegel Mining specifications of malicious behavior Proceedings of the 6th joint meeting of the European software engineering conference and the ACM SIGSOFT symposium on the foundations of software engineering 2007 ACM 5 14
7. W.W. Cohen Fast effective rule Induction Machine learning: Proceedings of the Twelfth International Conference on machine learning 1995 Morgan Kaufmann San Francisco, CA, USA 115 123
8. A. Dinaburg, P. Royal, M. Sharif, and W. Lee Ether: malware analysis via Hardware Virtualization Extensions Proceedings of the 15th ACM Conference on computer and communications Security 2008 ACM New York, NY, USA 51 62
9. T. Dube, R. Raines, G. Peterson, K. Bauer, M. Grimaila, and S. Rogers An investigation of malware type classification Proceedings of 5th international conference on information-warfare and security 2010 Academic Conferences Limited England 398 406
10. T. Dube, R. Raines, G. Peterson, K. Bauer, M. Grimaila, and S. Rogers Malware type recognition and cyber Situational awareness Proceedings of the IEEE second international conference on social computing 2010 IEEE 938 943
11. M. Hall, E. Frank, G. Holmes, B. Pfahringer, P. Reutemann, and I. Witten The WEKA data mining software: an update 2009 SIGKDD Explorations 11.1
12. V.X. Heavens Virus collection 2010 URL: (accessed 15.04.10)
13. O. Henchiri, and N. Japkowicz A feature selection and evaluation Scheme for computer virus detection Proceedings of the sixth international conference on data Mining 2006 IEEE 891 895
14. J.O. Kephart, and B. Arnold Automatic extraction of computer virus signatures Proceedings of the 4th virus bulletin international conference, Virus Bulletin 1994 Oxford UK 178 184
15. J. Kolter, and M. Maloof Learning to detect malicious executables in the Wild Proceedings of the Tenth ACM SIGKDD international conference on knowledge discovery and data Mining 2004 ACM 470 478 (Pubitemid 40114957)
16. J. Kolter, and M. Maloof Learning to detect and Classify malicious executables in the Wild Journal of Machine Learning Research 7 2006 2721 2744 (Pubitemid 46011490)
17. T. Lee, and J.J. Mody Behavioral classification Proceedings of EICAR 2006
18. J. Lobo, A. Jiménez-Valverde, and R. Real AUC: a misleading measure of the performance of predictive distribution models Global Ecology and Biogeography 17 2 2008 145 151 (Pubitemid 351228538)
19. M. Maloof Machine learning and data mining for computer security 2006 Springer London, UK
20. manpagez man page hexdump section 1 2004 URL: (accessed 12.10.10)
21. MathWorks, Inc. MATLAB 2010 URL:
22. MathWorks, Inc. TreeBagger 2010 URL: (accessed 05.12.10)
23. Microsoft Corporation Microsoft portable executable and common object file format specification 2008 URL: (accessed 23.12.09)
24. A. Moser, C. Kruegel, and E. Kirda Limits of static analysis for malware detection Annual computer security applications conference (ACSAC) 2007
25. Norman ASA Norman sandbox Sept. 2009 URL: (accessed 18.09.09)
26. N. Rafiq, and Y. Mao Improving heuristics Virus Bulletin 2008 9 12
27. M. Schultz, E. Eskin, E. Zadok, and S. Stolfo Data mining methods for detection of New malicious executables IEEE symposium on security and privacy 2001 IEEE 38 49 (Pubitemid 32882625)
28. ® Advisory CA-1992-02 Michelangelo PC virus Warning Sep. 1997 Carnegie Mellon University URL: (accessed 26.07.11)
29. Sunbelt Software Sunbelt cwsandbox Sept. 2009 URL: (accessed 18.09.09)
30. Symantec Corp. Understanding heuristics: symantec's bloodhound technology vol 1 1997 Symantec White Paper Series XXXIV pp. 1-14
31. P. Szor The Art of computer virus research and defense 2005 Addison-Wesley Indianapolis, IN, USA
32. G. Tesauro, J. Kephart, and G. Sorkin Neural networks for computer virus recognition IEEE Expert 11 4 1996 5 6 (Pubitemid 126796873)
33. ThreatExpert Ltd Automated threat analysis Feb. 2009 URL: (accessed 18.02.09)
34. S. Treadwell, and M. Zhou A heuristic approach for detection of obfuscated malware Intelligence and security informatics 2009 IEEE 291 299