A malware detection algorithm based on multi-view fusion

Authors:
Shanqing Guo;Qixia Yuan;Fengbo Lin;Fengyu Wang;Tao Ban
Affiliations:
Shandong University Jinan, Shandong, China;Shandong University Jinan, Shandong, China;Shandong University Jinan, Shandong, China;Shandong University Jinan, Shandong, China;Information Security Research Center, National Institute of Information and Communications Technology, Tokyo, Japan
Venue:
ICONIP'10 Proceedings of the 17th international conference on Neural information processing: models and applications - Volume Part II
Year:
2010

Citing 8
Cited 0

Machine Learning

Machine Learning
Intrusion Detection Using Variable-Length Audit Trail Patterns

RAID '00 Proceedings of the Third International Workshop on Recent Advances in Intrusion Detection
A Sense of Self for Unix Processes

SP '96 Proceedings of the 1996 IEEE Symposium on Security and Privacy
Semantics-Aware Malware Detection

SP '05 Proceedings of the 2005 IEEE Symposium on Security and Privacy
Data mining approaches for intrusion detection

SSYM'98 Proceedings of the 7th conference on USENIX Security Symposium - Volume 7
Learning and Classification of Malware Behavior

DIMVA '08 Proceedings of the 5th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Using spatio-temporal information in API calls with machine learning algorithms for malware detection

Proceedings of the 2nd ACM workshop on Security and artificial intelligence
Evolutionary neural networks for anomaly detection based on the behavior of a program

IEEE Transactions on Systems, Man, and Cybernetics, Part B: Cybernetics

Quantified Score

Hi-index	0.00

Visualization

Abstract

One of the major problems concerning information assurance is malicious code. In order to detect them, many existing run-time intrusion or malware detection techniques utilize information available in Application Programming Interface (API) call sequences to discriminate between benign and malicious processes. Although some great progresses have been made, the new research results of ensemble learning make it possible to design better malware detection algorithm. This paper present a novel approach of detecting malwares using API call sequences. Basing on the fact that the API call sequences of a software show local property when doing network, file IO and other operations, we first divide the API call sequences of a malware into seven subsequences, and then use each subsequence to build a classification model. After these building models are used to classify software, their outputs are combined by using BKS and the final fusion results will be used to label whether a software is malicious or not. Experiments show that our algorithm can detect known malware effectively.