Name
Abstract | ||
|---|---|---|
We present a technique for dynamic malware detection that relies on a set of sensors that monitor the interaction of applications with the underlying operating system. By monitoring the requests that each process makes to kernel-level operating system functions, we build a statistical model that describes both clean and infected systems in terms of the distribution of data collected from each sensor. The model parameters are learned from labeled training data gathered from machines infected with canonical samples of malware. We present a technique for detecting malware using the Neyman-Pearson test from classical detection theory. This technique classifies a system as either clean or infected at runtime as measurements are collected from the sensors. We provide experimental results that illustrate the effectiveness of this technique for a selection of malware samples. Additionally, we provide a performance analysis of our sensing and detection techniques in terms of the overhead they introduce to the system. Finally, we show this method to be effective in detecting previously unknown malware when trained to detect similar malware under similar load conditions. |
Year | DOI | Venue |
|---|---|---|
2011 | 10.1145/1998582.1998600 | ICAC |
Keywords | Field | DocType |
infected system,underlying operating system,unknown malware,dynamic malware detection,system function,kernel-level software sensor,model parameter,detection technique,malware infection,classical detection theory,similar malware,malware sample,data gathering,statistical model,fault tolerance,system monitoring,operating system,data collection,fault tolerant | Kernel (linear algebra),Training set,Data mining,Detection theory,Computer science,Real-time computing,System monitoring,Fault tolerance,Software,Statistical model,Malware | Conference |
Citations | PageRank | References |
3 | 0.42 | 17 |
Authors | ||
3 | ||
Name | Order | Citations | PageRank |
|---|---|---|---|
| Raymond Canzanese | 1 | 26 | 2.23 |
| Moshe Kam | 2 | 290 | 49.13 |
| Spiros Mancoridis | 3 | 888 | 56.82 |