Malicious sequential pattern mining for automatic malware detection

Expert Systems with Applications

Volumn 52, Issue , 2016, Pages 16-25

  Fan, Yujie ^a   Ye, Yanfang ^b   Chen, Lifei ^a,c  

^a FUJIAN NORMAL UNIVERSITY   (China)

^b West Virginia University   (United States)

^c UNIVERSITÉ DE SHERBROOKE   (Canada)

Author keywords

Classification; Instruction sequence; Malware detection; Sequential pattern mining

Indexed keywords

ALGORITHMS; CLASSIFICATION (OF INFORMATION); COMPUTER CRIME; COMPUTER VIRUSES; COMPUTER WORMS; DAMAGE DETECTION; DATA MINING; NEAREST NEIGHBOR SEARCH; PATTERN RECOGNITION; VIRUSES;

ALL NEAREST NEIGHBORS; DATA MINING FRAMEWORKS; DETECTION FRAMEWORK; INSTRUCTION SEQUENCE; MALICIOUS EXECUTABLES; MALWARE DETECTION; SEQUENTIAL PATTERNS; SEQUENTIAL-PATTERN MINING;

MALWARE;

EID: 84961351749     PISSN: 09574174     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.eswa.2016.01.002     Document Type: Article

References (37)

1. Abdelhamid N., Ayesh A., and Thabtah F. Phishing detection based associative classification data mining Expert Systems with Applications 41 2014 5948 5959
2. Ahmadi, M., Giacinto, G., Ulyanov, D., Semenov, S. Trofimov, M. (2015). Novel feature extraction, selection and fusion for effective malware family classification. arXiv: http://arxiv.org/abs/1511.04317.
3. Ahmadi M., Sami A., Rahimi H., and Yadegari B. Malware detection by behavioural sequential patterns Computer Fraud & Security 2013 2013 11 19
4. Austin T.H., Filiol E., Josse S., and Stamp M. Exploring hidden markov models for virus analysis: a semantic approach Proceedings of 46th hawaii international conference on system sciences 2013 5039 5048
5. Bazrafshan Z., Hashemi H., Fard S.M.H., and Hamzeh A. A survey on heuristic malware detection techniques Proceedings of the 5th conference on information and knowledge technology 2013 113 120
6. Bing L., Wynne H., and Ma Y. Integrating classification and association rule mining Proceedings of the 4th international conference on knowledge discovery and data mining 1998
7. C32Asm (2011). https://tuts4you.com/download.php?view.1130. Accessed 22.06.14.
8. Egele M., Scholte T., Kirda E., and Kruegel C. A survey on automated dynamic malware-analysis techniques and tools Computing Surveys 44 2012 6
9. Griffin K., Schneider S., Hu X., and Chiueh T.C. Automatic generation of string signatures for malware detection Proceedings of the 12th international symposium on recent advances in intrusion detection 2009 101 120
10. Guo G., Wang H., Bell D., Bi Y., and Greer K. KNN model-based approach in classification Volume 2888 of Lecture notes in computer science 2003 Springer 986 996
11. Han J., Kamber M., and Pei J. Data mining: Concepts and techniques 2006 Morgan Kaufmann
12. Hofmeyr S.A., Forrest S., and Somayaji A. Intrusion detection using sequences of system calls Journal of Computer Security 6 1998 151 180
13. Jain M., and Bajaj P. Techniques in detection and analyzing malware executables: A review International Journal of Computer Science and Mobile Computing 3 2014 930 933
14. Kephart J.O., and Arnold W.C. Automatic extraction of computer virus signatures Proceedings of 4th virus bulletin international conference 1994 178 184
15. Lo D., Cheng H., Han J., Khoo S., and Sun C. Classification of software behaviors for failure detection: a discriminative pattern mining approach Proceedings of the 15th international conference on knowledge discovery and data mining 2009 557 566
16. Narouei M., Ahmadi M., Giacinto G., Takabi H., and Sami A. DLLMiner: Structural mining for malware detection Security and Communication Networks 8 2015 3311 3322
17. Nissim N., Moskovitch R., Rokach L., and Elovici Y. Novel active learning methods for enhanced PC malware detection in windows OS Expert Systems with Applications 41 2014 5843 5857
18. Qiao Y., Yang Y., He J., Tang C., and Liu Z. CBM: Free, automatic malware analysis framework using API call sequences Knowledge engineering and management 2014 Springer 225 236
19. Rad B.B., Masrom M., and Ibrahim S. Opcodes histogram for classifying metamorphic portable executables malware Proceedings of international conference on e-learning and e-technologies in education 2012 209 213
20. McAfee Labs (2015). McAfee Labs threats report: May 2015. http://www.mcafee.com/us/resources/reports/rpquarterlythreatq12015.pdf. Accessed 17.12.15.
21. Runwal N., Low R.M., and Stamp M. Opcode graph similarity and metamorphic detection Journal in Computer Virology 8 2012 37 52
22. Santos I., Brezo F., Nieves J., Penya Y.K., Sanz B., Laorden C., and Bringas P.G. Idea: Opcode-sequence-based malware detection Engineering secure software and system 2010 Springer 35 43
23. Schultz M.G., Eskin E., Zadok E., and Stolfo S.J. Data mining methods for detection of new malicious executables Proceedings of the IEEE symposium on security and privacy 36 2001 38 49
24. Shabtai A., Moskovitch R., Feher C., Dolev S., and Elovici Y. Detecting unknown malicious code by applying classification techniques on opcode patterns Security Informatics 1 2012 1 22
25. Shen Y., Zhang Z., and Yang Q. Objective-oriented utility-based association mining Proceedings of the international conference on data mining 2002 426 433
26. Soucy P., and Mineau G.W. Beyond TFIDF weighting for text categorization in the vector space model Proceedings of international joint conference on artificial intelligence 5 2005 1130 1135
27. Srikant R., and Agrawal R. Mining sequential patterns: Generalizations and performance improvements 1996 Springer
28. Sun W.C., and Chen Y.M. A rough set approach for automatic key attributes identification of zero-day polymorphic worms Expert Systems with Applications 36 2009 4672 4679
29. Sundarkumar G.G., Ravi V., Nwogu I., and Govindaraju V. Malware detection via API calls, topic models and machine learning Proceedings of the international conference on automation science and engineering 2015 1212 1217
30. Symantec (2015). Symantec intelligent report: October 2015. http://www.symantec.com/content/en/us/enterprise/otherresources/b-intelligencereport102015enus.pdf. Accessed 17.12.15.
31. Uppal D., Sinha R., Mehra V., and Jain V. Malware detection and classification based on extraction of API sequences Proceedings of the international conference on advances in computing, communications and informatics 2014 2337 2342
32. Wchner T., Ochoa M., and Pretschner A. Malware detection with quantitative data flow graphs Proceedings of the 9th ACM symposium on information, computer and communications security 2014 271 282
33. Yang Y., and Pedersen J.O. A comparative study on feature selection in text categorization Proceedings of international conference on machine learning 97 1997 412 420
34. Ye Y., Li T., Chen Y., and Jiang Q. Automatic malware categorization using cluster ensemble Proceedings of the 16th international conference on knowledge discovery and data mining 2010 95 104
35. Ye Y., Wang D., Li T., Ye D., and Jiang Q. An intelligent PE-malware detection system based on association mining Journal in computer virology 4 2008 323 334
36. Zeng Y., Yang Y., and Zhao L. Pseudo nearest neighbor rule for pattern classification Expert Systems with Applications 36 2009 3587 3595
37. Zhang J.F., Chen L.F., and Guo G.D. Hierarchical feature selection method for detection of obfuscated malicious code Journal of Computer Applications 32 2012 2761 2767