A Layered Detection Method for Malware Identification

Abstract : In recent years, millions of new malicious programs are produced by Pa mature industry of malware production. These programs have tremendous challenges on the signature-based anti-virus products and pose great threats on network and information security. Machine learning techniques are applicable for detecting unknown malicious programs without knowing their signatures. In this paper, a Layered Detection (LD) method is developed to detect malwares with a two-layer framework. The Low-Level-Classifiers (LLC) are employed to identify whether the programs perform any malicious functions according to the API-calls of the programs. The Up-level-Classifier (ULC) is applied to detect malwares according to the low level function identification. The LD method is compared with many classical classification algorithms with comprehensive test datasets containing 16135 malwares and 1800 benign programs. The experiments demonstrate that the LD method outperforms other algorithms in terms of detection accuracy.
Type de document :
Communication dans un congrès
Erik Altman; Weisong Shi. 8th Network and Parallel Computing (NPC), Oct 2011, Changsha,, China. Springer, Lecture Notes in Computer Science, LNCS-6985, pp.166-175, 2011, Network and Parallel Computing. 〈10.1007/978-3-642-24403-2_14〉
Liste complète des métadonnées

Littérature citée [13 références]  Voir  Masquer  Télécharger

https://hal.inria.fr/hal-01593029
Contributeur : Hal Ifip <>
Soumis le : lundi 25 septembre 2017 - 16:34:10
Dernière modification le : vendredi 1 décembre 2017 - 01:09:45
Document(s) archivé(s) le : mardi 26 décembre 2017 - 14:49:52

Fichier

978-3-642-24403-2_14_Chapter.p...
Fichiers produits par l'(les) auteur(s)

Licence


Distributed under a Creative Commons Paternité 4.0 International License

Identifiants

Citation

Ting Liu, Xiaohong Guan, Yu Qu, Yanan Sun. A Layered Detection Method for Malware Identification. Erik Altman; Weisong Shi. 8th Network and Parallel Computing (NPC), Oct 2011, Changsha,, China. Springer, Lecture Notes in Computer Science, LNCS-6985, pp.166-175, 2011, Network and Parallel Computing. 〈10.1007/978-3-642-24403-2_14〉. 〈hal-01593029〉

Partager

Métriques

Consultations de la notice

66

Téléchargements de fichiers

11