DUET: Integration of dynamic and static analyses for malware clustering with cluster ensembles

ACM International Conference Proceeding Series

Volumn , Issue , 2013, Pages 79-88

  Hu, Xin ^a   Shin, Kang G ^b  

^a IBM T J WATSON RESEARCH CENTER   (United States)

^b UNIVERSITY OF MICHIGAN   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CLUSTER ENSEMBLES; CLUSTERING ENSEMBLE; DYNAMIC BEHAVIORS; DYNAMIC CLUSTERING; DYNAMIC CLUSTERING ALGORITHM; ENSEMBLE ALGORITHMS; SINGLE CLUSTERING ALGORITHMS; SINGLE CONSENSUS;

COMPUTER CRIME; SECURITY OF DATA; SECURITY SYSTEMS; STATIC ANALYSIS;

CLUSTERING ALGORITHMS;

EID: 84893321362     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2523649.2523677     Document Type: Conference Paper

References (32)

1. Unpackers. http://www.exetools.com/unpackers.htm.
2. C. C. Alexander Strehl, Joydeep Ghosh. Cluster ensembles - a knowledge reuse framework for combining multiple partitions. Journal of Machine Learning Research, 2002.
3. B. Anderson, C. Storlie, and T. Lane. Improving malware classification: bridging the static/dynamic gap. In Proceedings of the 5th ACM workshop on Security and artificial intelligence, AISec '12, 2012.
4. M. Bailey, J. Andersen, Z. M. mao, and F. Jahanian. Automated classification and analysis of internet malware. In In Proceedings of RAID, 2007.
5. D. Balzarotti, M. Cova, C. Karlberger, C. Kruegel, E. Kirda, and G. Vigna. Efficient detection of split personalities in malware. In NDSS, 2010.
6. U. Bayer, P. Comparetti, C. Hlauschek, C. Kruegel, and E. Kirda. Scalable, behavior-based malware clustering. In Proc. of the 16th NDSS, 2009.
7. M. Christodorescu and S. Jha. Static analysis of executables to detect malicious patterns. In Proc. of the 12th USENIX Security Symposium, 2003.
8. A. Dinaburg, P. Royal, M. Sharif, and W. Lee. Ether: malware analysis via hardware virtualization extensions. In Proceedings of CCS08, 2008.
9. A. Fattori, R. Paleari, L. Martignoni, and M. Monga. Dynamic and transparent analysis of commodity production systems. In Proceedings of ASE10, 2010.
10. A. Fred. Finding consistent clusters in data partitions. In Proc. 3d Int. Workshop on Multiple Classifier, 2001.
11. A. L. N. Fred and A. K. Jain. Data clustering using evidence accumulation. In Proceedings of the 16th International Conf. on Pattern Recognition, 2002.
12. A. Gionis, H. Mannila, and P. Tsaparas. Clustering aggregation. ACM Trans. Knowl. Discov. Data, 1, March 2007.
13. F. Guo, P. Ferrie, and T.-C. Chiueh. A study of the packer problem and its solutions. In RAID '08, 2008.
14. Y. Hong, S. Kwong, Y. Chang, and Q. Ren. Unsupervised feature selection using clustering ensembles and population based incremental learning algorithm. Pattern Recognition, 41(9): 2742-2756, 2008.
15. J. Jang, D. Brumley, and S. Venkataraman. Bitshred: feature hashing malware for scalable triage and semantic analysis. In Proceedings of CCS11, 2011.
16. M. E. Karim, A. Walenstein, A. Lakhotia, and L. Parida. Malware phylogeny generation using permutations of code. J. in Computer Virology, 2005.
17. Karypis Lab. Hypergraph partitioning software. http://glaros.dtc.umn.edu/ gkhome/views/metis, 2010.
18. C. Kolbitsch, E. Kirda, and C. Kruegel. The power of procrastination: detection and mitigation of execution-stalling malicious code. CCS '11, 2011.
19. J. Z. Kolter and M. A. Maloof. Learning to detect and classify malicious executables in the wild. Journal of Machine Learning Research, 7: 2006, 2006.
20. C. W. Konrad Rieck, Philipp Trinius and T. Holz. Automatic analysis of malware behavior using machine learning. Technical report, 2011.
21. C. Kruegel, E. Kirda, U. Bayer, D. Balzarotti, and I. Habibi. A view on current malware behaviors. In 2nd USENIX Workshop on LEET, 2009.
22. C. Kruegel, W. Robertson, F. Valeur, and G. Vigna. Static disassembly of obfuscated binaries. In USENIX Security'04, 2004.
23. T. Lee and J. J. Mody. Behavioral classification. In Proceedings of EICAR Conference, 2006.
24. C. Leita, U. Bayer, and E. Kirda. Exploiting diverse observation perspectives to get insights on the malware landscape. In DSN, 1 2010.
25. T. Liston. On the cutting edge: Thwarting virtual machine detection http://handlers.sans.org./tliston/ThwartingVMDetection-Liston-Skoudis.pdf.
26. A. Moser, C. Kruegel, and E. Kirda. Exploring multiple execution paths for malware analysis. In Proceedings of Oakland07, 2007.
27. K. Rieck, T. Holz, C. Willems, P. Düssel, and P. Laskov. Learning and classification of malware behavior. In Proceedings of DIMVA 08, 2008.
28. P. Security. Bredolab.aw. http://www.pandasecurity.com/homeusers/ securityinfo/220087/Bredolab.AW.
29. A. Srivastava and J. Giffin. Raid. In Recent Advances in Intrusion Detection. 2010.
30. S. K. Udupa, S. K. Debray, and M. Madou. Deobfuscation: Reverse engineering obfuscated code. Reverse Engineering, Working Conference on, 2005.
31. G. Wicherski. pehash: A novel approach to fast malware clustering. In LEET'2009.
32. Y. Ye, T. Li, Y. Chen, and Q. Jiang. Automatic malware categorization using cluster ensemble. In Proceedings of the 16th ACM SIGKDD, 2010.