A method for efficient malicious code detection based on conceptual similarity

Authors:
Sungsuk Kim;Chang Choi;Junho Choi;Pankoo Kim;Hanil Kim
Affiliations:
Dept. of Computer Science, Chosun University, Gwangju, Korea;Dept. of Computer Science, Chosun University, Gwangju, Korea;Dept. of Computer Engineering, Chosun University, Gwangju, Korea;Dept. of Computer Engineering, Chosun University, Gwangju, Korea;Dept. of Computer Education, Cheju National University, Cheju, Korea
Venue:
ICCSA'06 Proceedings of the 2006 international conference on Computational Science and Its Applications - Volume Part IV
Year:
2006

Citing 7
Cited 0

Conceptual structures: information processing in mind and machine

Conceptual structures: information processing in mind and machine
Learning to Generate CGs from Domain Specific Sentences

ICCS '01 Proceedings of the 9th International Conference on Conceptual Structures: Broadening the Base
Conceptual Graph Matching for Semantic Search

ICCS '02 Proceedings of the 10th International Conference on Conceptual Structures: Integration and Interfaces
Comparison of Conceptual Graphs

MICAI '00 Proceedings of the Mexican International Conference on Artificial Intelligence: Advances in Artificial Intelligence
Flexible Comparison of Conceptual GraphsWork done under partial support of CONACyT, CGEPI-IPN, and SNI, Mexico

DEXA '01 Proceedings of the 12th International Conference on Database and Expert Systems Applications
Static analysis of executables to detect malicious patterns

SSYM'03 Proceedings of the 12th conference on USENIX Security Symposium - Volume 12
Construction of conceptual graph representation of texts

HLT-SRWS '04 Proceedings of the Student Research Workshop at HLT-NAACL 2004

Quantified Score

Hi-index	0.01

Visualization

Abstract

Nowadays, a lot of techniques have been applied for the detection of malicious behavior. However, the current techniques taken into practice are facing with the challenge of much variations of the original malicious behavior, and it is impossible to respond the new forms of behavior appropriately and timely. With the questions above, we suggest a new method here to improve the current situation. Basically, we use conceptual graph to define malicious behavior, and then we are able to compare the similarity relations of the malicious behavior by testing the formalized values which generated by the predefined graphs in the code. In this paper, we show how to make a conceptual graph and propose an efficient method for similarity measure to discern the malicious behavior. As a result of our experiment, we can get more efficient detection rate. It can be used in detecting malicious codes in the script based programming environment of many kinds of embedded systems or telematics systems.