Earticle

초록

영어

Combating malware is very important for software/systems security, but to prevent the software/systems from the advanced malware, viz. metamorphic malware is a challenging task, as it changes the structure/code after each infection. Therefore in this paper, we present a novel approach to detect the advanced malware with high accuracy by analyzing the occurrence of opcodes (features) by grouping the executables. These groups are made on the basis of our earlier studies [1] that the difference between the sizes of any two malware generated by popular advanced malware kits viz. PS-MPC, G2 and NGVCK are within 5 KB. On the basis of obtained promising features, we studied the performance of thirteen classifiers using N-fold cross-validation available in machine learning tool WEKA. Among these thirteen classifiers we studied in-depth top five classifiers (Random forest, LMT, NBT, J48 and FT) and obtain more than 96.28% accuracy for the detection of unknown malware, which is better than the maximum detection accuracy (~95.9%) reported by Santos et al (2013). In these top five classifiers, our approach obtained a detection accuracy of ∼97.95% by the Random forest.

목차

Abstract
 1. Introduction
 2. Related Work
 3. Our Approach
  3.1. Building the Datasets and Feature Selection
  3.2. Training of the Classifiers
  3.3 Detection of Unknown Malware
 4. Experimental Results
 5. Conclusion
 Appendix
 Acknowledgments
 References

키워드

저자

• Ashu Sharma [ Research scholar, Department of Computer Science and Information SystemBirla Institute of Technology and Science, K. K. Birla Goa Campus, NH-17B, By Pass Road, Zuarinagar- 403726, Goa, India ]
• Sanjay K. Sahay [ Assistant Professor, Department of Computer Science and Information System, Birla Institute of Technology and Science, K. K. Birla Goa Campus, NH-17B, By Pass Road, Zuarinagar- 403726, Goa, India ]

참고문헌

발행기관

간행물

표지보기 관심저널 등록

• 간행물명

  International Journal of Security and Its Applications

• 간기

  격월간

• pISSN

  1738-9976

• 수록기간

  2008~2016

• 등재여부

  SCOPUS

• 십진분류

  KDC 505 DDC 605