Paper Info
Title
ELF-Miner: using structural knowledge and data mining methods to detect new (Linux) malicious executables
Abstract
Linux malware can pose a significant threat—its (Linux) penetration is exponentially increasing—because little is known or understood about Linux OS vulnerabilities. We believe that now is the right time to devise non-signature based zero-day (previously unknown) malware detection strategies before Linux intruders take us by surprise. Therefore, in this paper, we first do a forensic analysis of Linux executable and linkable format (ELF) files. Our forensic analysis provides insight into different features that have the potential to discriminate malicious executables from benign ones. As a result, we can select a features’ set of 383 features that are extracted from an ELF headers. We quantify the classification potential of features using information gain and then remove redundant features by employing preprocessing filters. Finally, we do an extensive evaluation among classical rule-based machine learning classifiers—RIPPER, PART, C4.5 Rules, and decision tree J48—and bio-inspired classifiers—cAnt Miner, UCS, XCS, and GAssist—to select the best classifier for our system. We have evaluated our approach on an available collection of 709 Linux malware samples from vx heavens and offensive computing. Our experiments show that ELF-Miner provides more than 99% detection accuracy with less than 0.1% false alarm rate.
Year
DOI
Venue
2012
10.1007/s10115-011-0393-5
Knowl. Inf. Syst.
Keywords
DocType
Volume
linux os vulnerability,linux intruder,data mining method,detection accuracy,structural knowledge,classification potential,elf header,elf · data mining · information security · structural information · malicious executables · machine learning · malware forensics · linux malware · evolutionary computing,forensic analysis,malicious executables,linux executable,linux malware sample,malware detection strategy,linux malware,information security,machine learning,evolutionary computing,false alarm rate,information gain,data mining,decision tree
Journal
30
Issue
ISSN
Citations 
3
0219-3116
11
PageRank 
References 
Authors
0.62
17
2
Name
Order
Citations
PageRank
Farrukh Shahzad1554.00
Muddassar Farooq2122183.47