Real-time malware detection framework in intrusion detection systems

Abstract

We suggest an efficient framework to detect malware in Intrusion Detection System (IDS). The framework generates signatures from malware families and generates corresponding detection rules. The generated signatures are not influenced by small changes of malware while they can be used to detect malware that has similar behaviors with normal programs. Our signatures are stored as an Aho-Corasick Tree form to improve signature matching performance in IDS.