Control flow-based opcode behavior analysis for Malware detection

被引：64

作者：

Ding, Yuxin ^{[1
]}

Dai, Wei ^{[1
]}

Yan, Shengli ^{[1
]}

Zhang, Yumei ^{[2
]}

机构：

[1] Shenzhen Univ Town, Harbin Inst Technol, Shenzhen Grad Sch, Shenzhen 518055, Peoples R China

[2] Chinese Acad Sci, State Key Lab Comp Architecture, Inst Comp Technol, Beijing 100864, Peoples R China

来源：

COMPUTERS & SECURITY | 2014年 / 44卷

关键词：

Opcode sequence; Malicious code detection; Control flow graph; Machine learning; Classification; Security;

D O I：

10.1016/j.cose.2014.04.003

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

Opcode sequences from decompiled executables have been employed to detect malware. Currently, opcode sequences are extracted using text-based methods, and the limitation of this method is that the extracted opcode sequences cannot represent the true behaviors of an executable. To solve this issue, we present a control flow-based method to extract executable opcode behaviors. The behaviors extracted by this method can fully represent the behavior characteristics of an executable. To verify the efficiency of control flow-based behaviors, we perform a comparative study of the two types of opcode behavior analysis methods. The experimental results indicate that the proposed control flow-based method has a higher overall accuracy and a lower false positive rate. (C) 2014 Elsevier Ltd. All rights reserved.

引用

页码：65 / 74

页数：10

共 26 条

[1] Improving support vector machine classifiers by modifying kernel functions [J].

Amari, S ;

Wu, S .

NEURAL NETWORKS, 1999, 12 (06) :783-789

[2]

[Anonymous], 1995, P NZ COMPUTER SCI RE

[3]

[Anonymous], 1996, Proceedings of 1996 IEEE Symposium on Security and Privacy, DOI DOI 10.1109/SECPRI.1996.502675

[4] Opcodes as predictor for malware [J].

Bilar, Daniel .

INTERNATIONAL JOURNAL OF ELECTRONIC SECURITY AND DIGITAL FORENSICS, 2007, 1 (02) :156-168

[5]

Cha BR, 2005, IEEE SYMP COMP COMMU, P427

[6]

Christopher D.Manning., 1999, FDN STAT NATURAL LAN

[7]

Dash SK, 2005, LECT NOTES COMPUT SC, V3803, P251

[8] A fast malware detection algorithm based on objective-oriented association mining [J].

Ding, Yuxin ;

Yuan, Xuebing ;

Tang, Ke ;

Xiao, Xiao ;

Zhang, Yibin .

COMPUTERS & SECURITY, 2013, 39 :315-324

[9] Feature representation and selection in malicious code detection methods based on static system calls [J].

Ding Yuxin ;

Yuan Xuebing ;

Zhou Di ;

Dong Li ;

An Zhanchao .

COMPUTERS & SECURITY, 2011, 30 (6-7) :514-524

[10]

Hex-Rays SA, 2009, IDA PROINTRODUCTION

← 1 2 3 →