POSTER: Detecting malware through temporal function-based features

Authors:
Eitan Menahem;Asaf Shabtai;Adi Levhar
Affiliations:
Ben-Gurion University of the Negev, Be'er Sheva, Israel;Ben-Gurion University of the Negev, Be'er Sheva, Israel;Ben-Gurion University of the Negev, Be'er Sheva, Israel
Venue:
Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security
Year:
2013

Citing 5
Cited 0

Panorama: capturing system-wide information flow for malware detection and analysis

Proceedings of the 14th ACM conference on Computer and communications security
Unknown Malcode Detection Using OPCODE Representation

EuroISI '08 Proceedings of the 1st European Conference on Intelligence and Security Informatics
Detection of malicious code by applying machine learning classifiers on static features: A state-of-the-art survey

Information Security Tech. Report
Automatic Generation of String Signatures for Malware Detection

RAID '09 Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection
F-Sign: Automatic, Function-Based Signature Generation for Malware

IEEE Transactions on Systems, Man, and Cybernetics, Part C: Applications and Reviews

Quantified Score

Hi-index	0.00

Visualization

Abstract

In order to evade detection by anti-virus software, malware writers use techniques, such as polymorphism, metamorphism and code re-writing. The result is that such malware contain a much larger fraction of "new" code, compared to benign programs, which tend to maximize code reuse. In this research we study this interesting property and show that by performing "archaeological" analysis of functions residing within binary files (i.e., estimating the functions` creation date), a new set of informative features can be derived. We show that these features provide a good indication for the existence of malicious code within binary files. Preliminary experiments of the proposed temporal function-based features with a set of over 12,000 files indicates that the proposed set of features can be useful for the detection of malicious files (accuracy of over 90% and AUC of 0.96).