Static Malware Analysis Using Machine Learning Methods

Communications in Computer and Information Science

Volumn 420 CCIS, Issue , 2014, Pages 440-450

  Nath, Hiran V ^a,b   Mehtre, Babu M ^a  

^a INSTITUTE FOR DEVELOPMENT AND RESEARCH IN BANKING TECHNOLOGY   (India)

^b UNIVERSITY OF HYDERABAD   (India)

Author keywords

Advanced Persistent Threat; Cyber Defence; Machine Learning; Malware; Static Analysis

Indexed keywords

ARTIFICIAL INTELLIGENCE; COMPUTER CRIME; LEARNING SYSTEMS; NETWORK SECURITY; STATIC ANALYSIS;

ADVANCED PERSISTENT THREAT; CRITICAL COMPONENT; CYBER DEFENCE; MACHINE LEARNING METHODS; MACHINE LEARNING TECHNIQUES; MALWARE DETECTION; SOCIAL ENGINEERING; ZERO DAY VULNERABILITIES;

MALWARE;

EID: 84904757898     PISSN: 18650929     EISSN: None     Source Type: Book Series    
DOI: 10.1007/978-3-642-54525-2_39     Document Type: Conference Paper

References (44)

1. The 'ICEFOG' APT: A tale of cloak and three daggers. Kaspersky Lab Global Research And Analysis Team(GREAT) (2013)
2. Balduzzi, M., Ciangaglini, V., McArdle, R.: Targeted attacks detection with spunge. Trend Micro Research, EMEA (2013)
3. Becker, G.T., Regazzoni, F., Paar, C., Burleson, W.P.: Stealthy dopant-level hardware trojans (2013)
4. Bencsáth, B., Pék, G., Buttyán, L., Félegyházi, M.: The cousins of stuxnet: Duqu, flame, and gauss. Future Internet 4(4), 971-1003 (2012)
5. Bilar, D.: Opcodes as predictor for malware. International Journal of Electronic Security and Digital Forensics 1(2), 156-168 (2007)
6. Blonce, A., Filiol, E., Frayssignes, L.: Portable document format (pdf) security analysis and malware threats. Tech. rep., Virology and Cryptology Laboratory, French Army Signals Academy (2008)
7. Cohen, W.W.: Fast effective rule induction. ICML 95, 115-123 (1995)
8. Desnos, A., Erra, R., Filiol, E.: Processor-dependent malwaret and codes. arXiv preprint arXiv:1011.1638 (2010)
9. Dube, T., Raines, R., Peterson, G., Bauer, K., Grimaila, M., Rogers, S.: Malware type recognition and cyber situational awareness. In: Second International Conference on Social Computing (SocialCom), pp. 938-943. IEEE (2010)
10. Dube, T., Raines, R., Peterson, G., Bauer, K., Grimaila, M., Rogers, S.: Malware target recognition via static heuristics. Computers & Security 31(1), 137-147 (2012)
11. Dube, T.E.: A Novel Malware Target Recognition Architecture for Enhanced Cyberspace Situation Awareness. Ph.D Thesis, Air Force Institute of Technology, Wright-Patterson Air Force Base, Ohio (September 2011)
12. Dube, T.E., Raines, R.A., Grimaila, M.R., Bauer, K., Rogers, S.: Malware target recognition of unknown threats. IEEE Systems Journal 7(3) (September 2013)
13. Dube, T.E., Raines, R.A., Rogers, S.K.: Malware target recognition. US Patent 20, 120, 260, 342 (October 11, 2012)
14. Filiol, E.: Formalisation and implementation aspects of k-ary (malicious) codes. Journal in Computer Virology 3(2), 75-86 (2007)
15. Filiol, E.: Malicious cryptography techniques for unreversable (malicious or not) binaries. arXiv preprint arXiv:1009.4000 (2010)
16. Filiol, E., Helenius, M., Zanero, S.: Open problems in computer virology. Journal in Computer Virology 1(3-4), 55-66 (2006)
17. Kolter, J.Z., Maloof, M.A.: Learning to detect and classify malicious executables in the wild. The Journal of Machine Learning Research 7, 2721-2744 (2006)
18. Kolter, J.Z., Maloof, M.A.: Dynamic weighted majority: An ensemble method for drifting concepts. The Journal of Machine Learning Research 8, 2755-2790 (2007)
19. Kolter, J.Z., Maloof, M.A.: Learning to detect malicious executables in the wild. In: Proceedings of the Tenth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 470-478. ACM (2004)
20. Kolter, J.Z., Maloof, M.A.: Using additive expert ensembles to cope with concept drift. In: Proceedings of the 22nd International Conference on Machine Learning, pp. 449-456. ACM (2005)
21. Li, F., Lai, A., Ddl, D.: Evidence of advanced persistent threat: A case study of malware for political espionage. In: 6th International Conference on Malicious and Unwanted Software (Malware), pp. 102-109. IEEE (2011)
22. Lin, L., Kasper, M., G̈uneysu, T., Paar, C., Burleson, W.: Trojan side-channels: Lightweight hardware trojans through side-channel engineering. In: Clavier, C., Gaj, K. (eds.) CHES 2009. LNCS, vol. 5747, pp. 382-395. Springer, Heidelberg (2009)
23. Liu, S.-T., Chen, Y.-M., Hung, H.-C.: N-victims: An approach to determine nvictims for apt investigations. In: Lee, D.H., Yung, M. (eds.) WISA 2012. LNCS, vol. 7690, pp. 226-240. Springer, Heidelberg (2012)
24. Lu, Y., Din, S., Zheng, C., Gao, B.: Using multi-feature and classifier ensembles to improve malware detection. Journal of CCIT 39(2), 57-72 (2010)
25. Lyda, R., Hamrock, J.: Using entropy analysis to find encrypted and packed malware. IEEE Security & Privacy 5(2), 40-45 (2007)
26. McDonald, G., Murchu, L.O., Doherty, S., Chien, E.: Stuxnet 0.5: The missing link. Symantec Security Response (online) 26 (2013)
27. Menn, J.: Key internet operator verisign hit by hackers. Reuters (February 2, 2012)
28. Muttik, I.: Zero-day malware. In: Virus Bulletin Conference (2010)
29. Prosecutors, Public: Messiah spyware infects middle east targets
30. Rafiq, N., Mao, Y.: Improving heuristics. In: Virus Bulletin Conference, pp. 9-12 (2008)
31. Raymond, D., Conti, G., Cross, T., Fanelli, R.: A control measure framework to limit collateral damage and propagation of cyber weapons. In: Fifth International Conference on Cyber Conflict (CyCon), pp. 1-16. IEEE (2013)
32. Santos, I., Brezo, F., Sanz, B., Laorden, C., Bringas, P.G.: Using opcode sequences in single-class learning to detect unknown malware. IET Information Security 5(4), 220-227 (2011)
33. Santos, I., Brezo, F., Ugarte-Pedrero, X., Bringas, P.G.: Opcode sequences as representation of executables for data-mining-based unknown malware detection. Information Sciences (2011)
34. Santos, I., Nieves, J., Bringas, P.G.: Semi-supervised learning for unknown malware detection. In: Abraham, A., Corchado, J.M., González, S.R., De Paz Santana, J.F. (eds.) International Symposium on DCAI. AISC, vol. 91, pp. 415-422. Springer, Heidelberg (2011)
35. Schultz, M.G., Eskin, E., Zadok, F., Stolfo, S.J.: Data mining methods for detection of new malicious executables. In: Proceedings of the 2001 IEEE Symposium on Security and Privacy, S&P 2001, pp. 38-49. IEEE (2001)
36. Shabtai, A., Moskovitch, R., Elovici, Y., Glezer, C.: Detection of malicious code by applying machine learning classifiers on static features: A state-of-the-art survey. Information Security Technical Report 14(1), 16-29 (2009)
37. Shafiq, M., Tabish, S., Farooq, M.: Pe-probe: leveraging packer detection and structural information to detect malicious portable executables. In: Proceedings of the Virus Bulletin Conference (VB), pp. 29-33 (2009)
38. Shafiq, M.Z., Tabish, S.M., Mirza, F., Farooq, M.: A framework for efficient mining of structural information to detect zero-day malicious portable executables. Tech. rep., TR-nexGINRC-2009-21 (January 2009), http://www.nexginrc.org/papers/tr21-zubair.pdf
39. Shafiq, M.Z., Tabish, S.M., Mirza, F., Farooq, M.: Pe-miner:mining structural information to detect malicious executables in realtime. In: Kirda, E., Jha, S., Balzarotti, D. (eds.) RAID 2009. LNCS, vol. 5758, pp. 121-141. Springer, Heidelberg (2009)
40. Sood, A., Enbody, R.: Targeted cyber attacks-a superset of advanced persistent threats. In: IEEE Computer and Reliability Societies, Michigan State University (2013)
41. Vasiliadis, G., Polychronakis, M., Ioannidis, S.: Gpu-assisted malware. In: 2010 5th International Conference on Malicious and Unwanted Software (MALWARE), pp. 1-6. IEEE (2010)
42. White, S.R.: Open problems in computer virus research. In: Virus Bulletin Conference (1998)
43. Zetter, K.: Google hack attack was ultra sophisticated, new details show. Wired Magazine 14 (2010)
44. Zhang, B., Yin, J., Hao, J., Zhang, D., Wang, S.: Malicious codes detection based on ensemble learning. In: Xiao, B., Yang, L.T., Ma, J., Muller-Schloer, C., Hua, Y. (eds.) ATC 2007. LNCS, vol. 4610, pp. 468-477. Springer, Heidelberg (2007)