Statistical approach towards malware classification and detection

TY - CHAP

T1 - Statistical approach towards malware classification and detection

AU - Ghanaei, Vida

AU - Iliopoulos, Costas S.

AU - Overill, Richard E.

PY - 2016/8/29

Y1 - 2016/8/29

N2 - Anti-virus companies receive extensive quantities of malware variants daily; therefore, it is essential to automatically classify them into their corresponding malware family. Here, we apply an efficient statistical approach to identify and render critical malicious patterns into malware families, which are essential elements of automated classification of known and unknown malware variants in large quantities. Critical malicious patterns are the most frequent basic blocks, which are present most often in one specific malware family, and comparatively less in all other malware families. By computing the distribution frequency of each distinct basic block residing in all the malware families, the importance of being a potential representative of a critical malicious pattern for a specific malware family is measured. This value is carefully computed by considering the population of each malware family, and the distribution frequency ratio of every distinct basic block among the different malware families. The results show that known and unknown malware variants can be effectively and accurately classified into their related malware family using this approach.

AB - Anti-virus companies receive extensive quantities of malware variants daily; therefore, it is essential to automatically classify them into their corresponding malware family. Here, we apply an efficient statistical approach to identify and render critical malicious patterns into malware families, which are essential elements of automated classification of known and unknown malware variants in large quantities. Critical malicious patterns are the most frequent basic blocks, which are present most often in one specific malware family, and comparatively less in all other malware families. By computing the distribution frequency of each distinct basic block residing in all the malware families, the importance of being a potential representative of a critical malicious pattern for a specific malware family is measured. This value is carefully computed by considering the population of each malware family, and the distribution frequency ratio of every distinct basic block among the different malware families. The results show that known and unknown malware variants can be effectively and accurately classified into their related malware family using this approach.

KW - Malicious Features

KW - Malware Classification

KW - Pattern Matching

KW - Shared Code

KW - Statistical

UR - http://www.scopus.com/inward/record.url?scp=84988878580&partnerID=8YFLogxK

U2 - 10.1109/SAI.2016.7556114

DO - 10.1109/SAI.2016.7556114

M3 - Conference paper

AN - SCOPUS:84988878580

SN - 9781467384605

SP - 1093

EP - 1099

BT - Proceedings of 2016 SAI Computing Conference, SAI 2016

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 2016 SAI Computing Conference, SAI 2016

Y2 - 13 July 2016 through 15 July 2016

ER -