.png){kind=icon}
Return
Feature representation and selection in malicious code detection methods based on static system calls
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2011.05.007.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Currently almost all static methods for detecting malicious code are signature-based, this leads the result that viruses can easily escape detection by simple mechanisms such as code obfuscation. In this paper, a behavior-based detection approach is proposed to address this problem. The behaviors of interest are defined as static system call sequences. Unlike the traditional approach, which derives system call sequences by running executables (i.e., dynamic system call sequences), this approach statically analyzes binary code to derive system call sequences. In this paper, a method for deriving static system call sequences is presented, and two automatic feature-selection methods based on n-grams are proposed. We use machine-learning methods, including the K-nearest neighbor, Support Vector Machine, and decision tree methods to classify executables. The proposed approach is compared with the dynamic detection approach using dynamic system call sequences. The experimental results show that the proposed approach has higher accuracy and a lower false positive rate than the dynamic detection approach. (C) 2011 Elsevier Ltd. All rights reserved.
Keywords:
Malicious code
Static detection
N-gram
System call
Security
Journal
C
IF:
5.4
Papers:
4.6K
Citations:
1.4W
Organization
Cited Papers
.png){kind=icon}
ShareSaveShareSaveParameter Identification of Battery Model Based on Forgetting Factor Recursive Least Square Method
PREAI
ShareSaveShareSave
View more