A scalable implementation of malware detection based on network connection behaviors

Proceedings - 2013 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery, CyberC 2013

Volumn , Issue , 2013, Pages 59-66

  Shi, Liang ^a   Que, Jialan ^a   Zhong, Zhenyu ^a   Meyer, Brett ^a   Crenshaw, Patrick ^a   He, Yuanchen ^a  

^a Data Mining Research McAfee Labs   (United States)

Author keywords

Clustering; False positive; Malware; Scalable

Indexed keywords

DISTRIBUTED COMPUTER SYSTEMS; HARDWARE;

CLUSTERING; CLUSTERING APPROACH; FALSE POSITIVE; FALSE POSITIVE RATES; MALWARES; NETWORK CONNECTION; SCALABLE; SCALABLE IMPLEMENTATION;

COMPUTER CRIME;

EID: 84893231146     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CyberC.2013.19     Document Type: Conference Paper

References (23)

1. "Mcafee threats report, fourth quarter 2012," http://www.mcafee.com, McAfee Lab, Tech. Rep., 2012.
2. C. Willems, T. Holz, and F. Freiling, "Toward automated dynamic malware analysis using cwsandbox," Security Privacy, IEEE, Vol. 5, pp. 32-39, 2007.
3. K. Rieck, T. Holz, C. willems, P. Dussel, and P. Laskov, "Learning and classification of malware behavior," in The 5th Conference on Detection of Intrusions and Malware & Vulnerability Assessment, 2008.
4. C. Kolbitsch, P. M. Comparetti, C. Kruegel, E. Kirdaand, X. Zhou, and X. Wang, "Effective and efficient malware detection at the end host," in SSYM'09 Proceedings of the 18th conference on USENIX security symposium, 2009, pp. 351-366.
5. W. L. U. S. J. Zhang, R. Perdisci and X. Luo, "Detecting stealthy p2p botnets using statistical traffic fingerprints," in IEEE/IFIP 41st International Conference on Dependable Systems & Networks (DSN), 2011.
6. M. Bailey, J. Andersen, Z. Morleymao, and F. Jahanian, "Automated classification and analysis of internet malware," in Proceedings of the 2007 Conference on Recent Advances in Intrusion Detection, 2007.
7. U. Bayer, P. M. Comparetti, C. Hlausckek, C. Kruegel, and E. Kirda, "Scalable, behavior-based malware clustering," in Network and Distributed System Security Symposium, 2009.
8. R. Perdisci, W. Lee, and N. Feamster, "Behavioral clustering of http-based malware and signature generation using malicious network traces," in Proceedings of the 7th USENIX conference on Networked systems design and implementation, 2010.
9. E. Kohler, "Observed structure of addresses in ip traffic," in IEEE/ACM Transactions on Networking, 2006.
10. W. Willinger, V. Paxson, and M. S. Taqqu, Self-similarity and heavy tails: Structural modeling of network traffic. New York: Chapman & Hall, 1998.
11. M. Sikorski and A. Honig, Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software, 1st ed. San Francisco, CA: No Starch Press, 2012.
12. T. Holz, C. Gorecki, K. Rieck, and F. C. Freiling, "Measuring and detecting fast-flux service networks," in Proceedings of the Network and Distributed System Security Symposium, 2008.
13. Z. Sadan and D. G. Schwartz, "Social network analysis for cluster-based ip spam reputation," in Information Management & Computer Security, Vol. 20, 2012, pp. 281-295.
14. E. Stalmans, "A framework for dns based detection and mitigation of malware infections on a network," in Information Security South Africa (ISSA), 2011.
15. J. Dean and S. Ghemawat, "Mapreduce: simplified data processing on large clusters," Communications of the ACM, Vol. 51, no. 1, pp. 107-113, 2008.
16. "Algorithms - apache mahout - apache software foundation," 2012 (last updated), retrieved November 2012.
17. https://www.virustotal.com/en/.
18. P. Li, L. Liu, D. Gao, and M. K. Reiter, "On challenges in evaluating malware clustering," in Proceedings of the 13th international conference on Recent advances in intrusion detection, 2011.
19. R. Perdisci, D. Ariu, and G. Giacinto, "Scalable fine-grained behavioral clustering of http-based malware," in Computer Networks, 2012.
20. G. Gu, R. Perdisci, J. Zhang, and W. Lee, "Botminer: clustering analysis of network traffic for protocol- and structure-independent botnet detection," in Proceedings of the 17th USENIX Security Symposium, 2008.
21. S. Shin, Z. Xu, and G. Gu, "Effort: Efficient and effective bot malware detection," in INFOCOM, 2012 Proceedings IEEE, 2012, pp. 2846-2850.
22. J. Jang, D. Brumley, and S. Venkataraman, "Bitshred: feature hashing malware for scalable triage and semantic analysis," in Proceedings of the 18th ACM conference on Computer and communications security, 2011.
23. T. White, Hadoop: The definitive guide. O'Reilly Media, 2012.