.png){kind=icon}
返回
Deriving common malware behavior through graph clustering
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2013.09.006.png)
.png){kind=icon}
.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Detection of malicious software (malware) continues to be a problem as hackers devise new ways to evade available methods. The proliferation of malware and malware variants requires new advanced methods to detect them. This paper proposes a method to construct a common behavioral graph representing the execution behavior of a family of malware instances. The method generates one common behavioral graph by clustering a set of individual behavioral graphs, which represent kernel objects and their attributes based on system call traces. The resulting common behavioral graph has a common path, called HotPath, which is observed in all the malware instances in the same family. The proposed method shows high detection rates and false positive rates close to 0%. The derived common behavioral graph is highly scalable regardless of new instances added. It is also robust against system call attacks. (C) 2013 Elsevier Ltd. All rights reserved.
Keyword:
Malware
Dynamic analysis
Graph clustering
Intrusion detection
Virtualization
期刊
C
IF:
5.4
论文数:
4.6K
被引数:
1.4W
机构
查看更多机构
引用论文
Mineralogy and crystal chemistry of Mn, Fe, Co, Ni, and Cu in a deep-sea Pacific polymetallic nodule
OAAI
OAAI分享收藏
A set of robust fluorescent peptide probes for quantification of Cu(ii) binding affinities in the micromolar to femtomolar range.png)
MetallomicsOAAI
MetallomicsIF0
OAAI分享收藏 没有更多内容