Evolutionary algorithms for classification of malware families through different network behaviors

GECCO 2014 - Proceedings of the 2014 Genetic and Evolutionary Computation Conference

Volumn , Issue , 2014, Pages 1167-1174

  Rafique, M Zubair ^a   Chen, Ping ^a   Huygens, Christophe ^a   Joosen, Wouter ^a  

^a UNIVERSITY OF LEUVEN   (Belgium)

Author keywords

Machine learning; Malware classification; Network behaviors

Indexed keywords

EVOLUTIONARY ALGORITHMS; LEARNING SYSTEMS;

AUTOMATIC CLASSIFICATION; CLASSIFICATION FRAMEWORK; MALWARE CLASSIFICATIONS; MALWARE FAMILIES; NETWORK BEHAVIORS; POLYMORPHIC VARIANT; STATE - SPACE MODELS; SUPERVISED CLASSIFIERS;

MALWARE;

EID: 84905717373     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2576768.2598238     Document Type: Conference Paper

References (32)

1. S. Afaneh et al. Virus detection using clonal selection algorithm with genetic algorithm (vdc algorithm). Applied Soft Computing, 13(1):239-246, 2013.
2. J. Alcalá-Fdez et al. KEEL: A Software Tool to Assess Evolutionary Algorithms for Data Mining Problems. Soft Comput., 13(3):307-318, 2008.
3. J. Bacardit. Analysis of the Initialization Stage of a Pittsburgh Approach Learning Classifier System. In Proceedings of the 7th Annual Conference on Genetic and Evolutionary Computation, pages 1843-1850. ACM, 2005.
4. Z. Bazrafshan et al. A survey on heuristic malware detection techniques. In Proceedings of the 5th Conference on Information and Knowledge Technology (IKT), pages 113-120. IEEE, 2013.
5. E. Bernadó-Mansilla and J. M. Garrell-Guiu. Accuracy-based Learning Classifier Systems: Models, Analysis and Applications to Classification Tasks. Evol. Comput., 11(3):209-238, 2003.
6. D. Bruschi et al. Detecting Self-mutating Malware Using Control-flow Graph Matching. In Proceedings of the Detection of Intrusions and Malware & Vulnerability Assessment, pages 129-143. Springer, 2006.
7. J. Caballero et al. Measuring Pay-per-Install: The Commoditization of Malware Distribution. In USENIX Security Symposium, 2011.
8. T. Cover and P. Hart. Nearest neighbor pattern classification. IEEE Trans. on Information Theory, 13(1):21-27, 1967.
9. T. Cover and J. A. Thomas. Elements of information theory, volume 306. Wiley Online, 1991.
10. Why spam is annoying but malware is frightening. http://blog.emsisoft. com/2013/11/13/annoying-spam/.
11. A. González and R. Pérez. Slave: A genetic learning system based on an iterative approach. IEEE Trans. on Fuzzy Systems, 7(2):176-191, 1999.
12. C. Grier et al. Manufacturing Compromise: The Emergence of Exploit-as-a-service. In Proceedings of the ACM Conference on Computer and Communications Security, pages 821-832. ACM, 2012.
13. T. Hill and P. Lewicki. Statistics: methods and applications. StatSoft, 2006.
14. J. Jang et al. BitShred: Feature Hashing Malware for Scalable Triage and Semantic Analysis. In Proceedings of the 18th ACM Conference on Computer and Communications Security, pages 309-320. ACM, 2011.
15. K. Kim and B.-R. Moon. Malware Detection Based on Dependency Graph Using Hybrid Genetic Algorithm. In Proceedings of the 12th Annual Conference on Genetic and Evolutionary Computation, pages 1211-1218. ACM, 2010.
16. Mcafee threats report: First quarter 2013. http://www.mcafee. com/au/resources/reports/rp-quarterly-threat-q1-2013.pdf.
17. Malware Domain List. http://malwaredomainlist.com/.
18. S. B. Mehdi et al. IMAD: In-execution Malware Analysis and Detection. In Proceedings of the 11th Annual Conference on Genetic and Evolutionary Computation, pages 1553-1560. ACM, 2009.
19. A. Mohaisen and O. Alrawi. Unveiling Zeus: Automated Classification of Malware Samples. In Proceedings of the 22nd International Conference on World Wide Web, pages 829-832, 2013.
20. A. Nappa et al. Driving in the Cloud: An Analysis of Drive-by Download Operations and Abuse Reporting. In Detection of Intrusions and Malware, and Vulnerability Assessment, volume 7967, pages 1-20. Springer, 2013.
21. R. Perdisci et al. Behavioral Clustering of HTTP-based Malware and Signature Generation Using Malicious Network Traces. In Proceedings of the 7th USENIX Conference on Networked Systems Design and Implementation, pages 26-26. USENIX Association, 2010.
22. J. R. Quinlan. Improved use of continuous attributes in C4.5. Journal of Art. Int. Res., 4:77-90, 1996.
23. M. Z. Rafique and M. Abulaish. xMiner: Nip the Zero Day Exploits in the Bud. In Proceedings of the 10th International Symposium on Network Computing and Applications, pages 99-106. IEEE Computer Society, 2011.
24. M. Z. Rafique and J. Caballero. Firma: Malware clustering and network signature generation with mixed network behaviors. In Proceedings of the 16th International Symposium on Research in Attacks, Intrusions and Defenses, pages 144-163. 2013.
25. M. Z. Rafique et al. Application of Evolutionary Algorithms in Detecting SMS Spam at Access Layer. In Proceedings of the 13th Annual Conference on Genetic and Evolutionary Computation, pages 1787-1794. ACM, 2011.
26. K. Rieck et al. Learning and Classification of Malware Behavior. In Proceedings of the 5th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, pages 108-125. Springer-Verlag, 2008.
27. I. Rish. An empirical study of the naive Bayes classifier. In Workshop on Empirical Methods in Artificial Intelligence, pages 41-46, 2001.
28. M. Z. Shafiq et al. On the appropriateness of evolutionary rule learning algorithms for malware detection. In Proceedings of the 11th Annual Conference on Genetic and Evolutionary Computation Conference, pages 2609-2616. ACM, 2009.
29. Sophos report. http://www.sophos.com/en-us/medialibrary/ PDFs/other/sophos-security-threat-report-2014.pdf.
30. S. Wilson. Generalization in the XCS classifier system. In AGPC, pages 665-674. Morgan Kaufmann, 1998.
31. J. Wyke. The zeroaccess botnet: Mining and fraud for massive financial gain. http://www.sophos.com/en-us/why-sophos/ our-people/technical-papers/ zeroaccess-botnet.aspx.
32. Zeus tracker. https://zeustracker.abuse.ch/index.php.