Earticle

초록

영어

In this work, we compare the research methodology and performance of malware detection using data mining. Feature selection is an important problem in data mining. For the malware application, it is interesting to see which features that can be used to characterize the malware. Particularly, we are interested to compare two approaches that use features based on statistical values and the instructions. We adapt the experiment methodology using statistical features in [1] using 1,2,3 grams and varying block sizes as well as the methodology using the abstract assembly in [2] using 1,2,3 grams of consecutive instructions. We apply to our selected test set which is the data set from [3]. The decision tree J48 is used to model to detect three classes: Allapple, Podnuha, Virut. From the comparison experiments, it is found that the approach that considers the instruction set feature performs better. The test with the application set can give up to 100% correctness using the instruction features.

목차

Abstract
 1. Introduction
 2. Backgrounds and Related Works
 3. Methodology
  3.1. Statistical Features Approach
  3.2 Abstract Assembly Approach
 4. Results
 5. Conclusion and Future Work
 References

키워드

저자

• Sathaporn Srakaew Warot Piyanuntcharatsr [ Dept. of Computing, Faculty of Science, Silpakorn University, Thailand ]
• Suchitra Adulkasem [ Dept. of Computing, Faculty of Science, Silpakorn University, Thailand ]
• Chantana Chantrapornchai [ Dept. of Computer Engineering, Faculty of Engineering, Kasetsart University, Bangkok, Thailand ] Corresponding Author

참고문헌

발행기관

간행물

표지보기 관심저널 등록

• 간행물명

  International Journal of Security and Its Applications

• 간기

  격월간

• pISSN

  1738-9976

• 수록기간

  2008~2016

• 등재여부

  SCOPUS

• 십진분류

  KDC 505 DDC 605