Malware detection: program run length against detection rate
- Authors
- Okane, Philip; Sezer, Sakir; McLaughlin, Kieran; Im, Eul Gyu
- Issue Date
- Feb-2014
- Publisher
- INST ENGINEERING TECHNOLOGY-IET
- Keywords
- invasive software; pattern classification; runlength codes; support vector machines; system monitoring; program classifier; opcode density histograms; malicious software; benign software; SVM classification; support vector machine; program monitoring time; operational codes; dynamic analysis; N-gram analysis; detection rate; program run length; malware detection
- Citation
- IET SOFTWARE, v.8, no.1, pp.42 - 51
- Indexed
- SCIE
SCOPUS
- Journal Title
- IET SOFTWARE
- Volume
- 8
- Number
- 1
- Start Page
- 42
- End Page
- 51
- URI
- https://scholarworks.bwise.kr/hanyang/handle/2021.sw.hanyang/160718
- DOI
- 10.1049/iet-sen.2013.0020
- ISSN
- 1751-8806
- Abstract
- N-gram analysis is an approach that investigates the structure of a program using bytes, characters or text strings. This research uses dynamic analysis to investigate malware detection using a classification approach based on N-gram analysis. A key issue with dynamic analysis is the length of time a program has to be run to ensure a correct classification. The motivation for this research is to find the optimum subset of operational codes (opcodes) that make the best indicators of malware and to determine how long a program has to be monitored to ensure an accurate support vector machine (SVM) classification of benign and malicious software. The experiments within this study represent programs as opcode density histograms gained through dynamic analysis for different program run periods. A SVM is used as the program classifier to determine the ability of different program run lengths to correctly determine the presence of malicious software. The findings show that malware can be detected with different program run lengths using a small number of opcodes.
- Files in This Item
-
Go to Link
- Appears in
Collections - 서울 공과대학 > 서울 컴퓨터소프트웨어학부 > 1. Journal Articles
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.