Malware target recognition via static heuristics

doi:10.1016/j.cose.2011.09.002

Malware target recognition via static heuristics

2012-02-01

22

PRE

AI

DOI：10.1016/j.cose.2011.09.002

Original

Original request for help

Save

Abstract

En 中文

Organizations increasingly rely on the confidentiality, integrity and availability of their information and communications technologies to conduct effective business operations while maintaining their competitive edge. Exploitation of these networks via the introduction of undetected malware ultimately degrades their competitive edge, while taking advantage of limited network visibility and the high cost of analyzing massive numbers of programs. This article introduces the novel Malware Target Recognition (MaTR) system which combines the decision tree machine learning algorithm with static heuristic features for malware detection. By focusing on contextually important static heuristic features, this research demonstrates superior detection results. Experimental results on large sample datasets demonstrate near ideal malware detection performance (99.9+% accuracy) with low false positive (8.73e-4) and false negative rates (8.03e-4) at the same point on the performance curve. Test results against a set of publicly unknown malware, including potential advanced competitor tools, show MaTR's superior detection rate (99%) versus the union of detections from three commercial antivirus products (60%). The resulting model is a fine granularity sensor with potential to dramatically augment cyberspace situation awareness. Published by Elsevier Ltd.

Keywords:

Malware detection

Intrusion detection

Malware

Situation awareness

Machine learning

Malware target recognition via static heuristics

Abstract

Journal

Organization