Data Mining Methods for Detection of New Malicious Executables

Authors:
Matthew G. Schultz;Eleazar Eskin;Erez Zadok;Salvatore J. Stolfo
Affiliations:
-;-;-;-
Venue:
SP '01 Proceedings of the 2001 IEEE Symposium on Security and Privacy
Year:
2001

Citing 0
Cited 88

Data mining-based intrusion detectors: an overview of the columbia IDS project

ACM SIGMOD Record
MEF: Malicious Email Filter - A UNIX Mail Filter That Detects Malicious Windows Executables

Proceedings of the FREENIX Track: 2001 USENIX Annual Technical Conference
MET: an experimental system for Malicious Email Tracking

Proceedings of the 2002 workshop on New security paradigms
Locality: a new paradigm for thinking about normal behavior and outsider threat

Proceedings of the 2003 workshop on New security paradigms
Learning to detect malicious executables in the wild

Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining
Detecting Flaws and Intruders with Visual Data Analysis

IEEE Computer Graphics and Applications
Detecting mass-mailing worm infected hosts by mining DNS traffic data

Proceedings of the 2005 ACM SIGCOMM workshop on Mining network data
Classification methods in the detection of new malicious emails

Information Sciences—Informatics and Computer Science: An International Journal
A retrovirus inspired algorithm for virus detection & optimization

Proceedings of the 8th annual conference on Genetic and evolutionary computation
Fighting cybercrime: a review and the Taiwan experience

Decision Support Systems - Special issue: Intelligence and security informatics
Comparison of feature selection and classification algorithms in identifying malicious executables

Computational Statistics & Data Analysis
An efficient signature representation and matching method for mobile devices

WICON '06 Proceedings of the 2nd annual international workshop on Wireless internet
Learning to Detect and Classify Malicious Executables in the Wild

The Journal of Machine Learning Research
Probabilistic suffix models for API sequence analysis of Windows XP applications

Pattern Recognition
A scalable multi-level feature extraction technique to detect malicious executables

Information Systems Frontiers
Frequent pattern mining for kernel trace data

Proceedings of the 2008 ACM symposium on Applied computing
Malicious code detection method over IPv4/IPv6 tunneling using Naive Bayesian classifier

ISP'06 Proceedings of the 5th WSEAS International Conference on Information Security and Privacy
Detection of unknown computer worms based on behavioral classification of the host

Computational Statistics & Data Analysis
Efficient signature based malware detection on mobile devices

Mobile Information Systems
New Malicious Code Detection Based on N-Gram Analysis and Rough Set Theory

Computational Intelligence and Security
A Study of Malcode-Bearing Documents

DIMVA '07 Proceedings of the 4th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Applying Machine Learning Techniques for Detection of Malicious Code in Network Traffic

KI '07 Proceedings of the 30th annual German conference on Advances in Artificial Intelligence
A Novel Immune Based Approach for Detection of Windows PE Virus

ADMA '08 Proceedings of the 4th international conference on Advanced Data Mining and Applications
Malware detection using adaptive data compression

Proceedings of the 1st ACM workshop on Workshop on AISec
Unknown Malcode Detection Using OPCODE Representation

EuroISI '08 Proceedings of the 1st European Conference on Intelligence and Security Informatics
BotMiner: clustering analysis of network traffic for protocol- and structure-independent botnet detection

SS'08 Proceedings of the 17th conference on Security symposium
Improving malware detection by applying multi-inducer ensemble

Computational Statistics & Data Analysis
Intelligent virus detection on mobile devices

Proceedings of the 2006 International Conference on Privacy, Security and Trust: Bridge the Gap Between PST Technologies and Business Services
A Chronological Evaluation of Unknown Malcode Detection

PAISI '09 Proceedings of the Pacific Asia Workshop on Intelligence and Security Informatics
Detection of malicious code by applying machine learning classifiers on static features: A state-of-the-art survey

Information Security Tech. Report
Intelligent file scoring system for malware detection from the gray list

Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining
Malicious Code Detection Using Active Learning

Privacy, Security, and Trust in KDD
A survey of data mining techniques for malware detection using file features

Proceedings of the 46th Annual Southeast Regional Conference on XX
Exploiting an antivirus interface

Computer Standards & Interfaces
Review: Intrusion detection by machine learning: A review

Expert Systems with Applications: An International Journal
Malware detection using statistical analysis of byte-level file content

Proceedings of the ACM SIGKDD Workshop on CyberSecurity and Intelligence Informatics
PE-Miner: Mining Structural Information to Detect Malicious Executables in Realtime

RAID '09 Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection
Prototype demonstration: trojan detection and defense system

CCNC'09 Proceedings of the 6th IEEE Conference on Consumer Communications and Networking Conference
Fighting cybercrime: a review and the Taiwan experience

Decision Support Systems - Special issue: Intelligence and security informatics
Design of effective anti-malware system for mobile industrial devices based on windows CE

ICACT'09 Proceedings of the 11th international conference on Advanced Communication Technology - Volume 3
Classification methods in the detection of new malicious emails

Information Sciences: an International Journal
Data mining methods for malware detection using instruction sequences

AIA '08 Proceedings of the 26th IASTED International Conference on Artificial Intelligence and Applications
Malware detection based on mining API calls

Proceedings of the 2010 ACM Symposium on Applied Computing
Detecting metamorphic malwares using code graphs

Proceedings of the 2010 ACM Symposium on Applied Computing
A multi-agent mechanism in machine learning approach to anti-virus system

KES-AMSTA'08 Proceedings of the 2nd KES International conference on Agent and multi-agent systems: technologies and applications
Static analysis of executables for collaborative malware detection on android

ICC'09 Proceedings of the 2009 IEEE international conference on Communications
CIMDS: adapting postprocessing techniques of associative classification for malware detection

IEEE Transactions on Systems, Man, and Cybernetics, Part C: Applications and Reviews
Malware detection based on dependency graph using hybrid genetic algorithm

Proceedings of the 12th annual conference on Genetic and evolutionary computation
Hierarchical associative classifier (HAC) for malware detection from the large and imbalanced gray list

Journal of Intelligent Information Systems
Automatic malware categorization using cluster ensemble

Proceedings of the 16th ACM SIGKDD international conference on Knowledge discovery and data mining
AccessMiner: using system-centric models for malware protection

Proceedings of the 17th ACM conference on Computer and communications security
Aiding prediction algorithms in detecting high-dimensional malicious applications using a randomized projection technique

Proceedings of the 48th Annual Southeast Regional Conference
Pattern recognition techniques for the classification of malware packers

ACISP'10 Proceedings of the 15th Australasian conference on Information security and privacy
A study of detecting computer viruses in real-infected files in the n-gram representation with machine learning methods

IEA/AIE'10 Proceedings of the 23rd international conference on Industrial engineering and other applications of applied intelligent systems - Volume Part I
Determining malicious executable distinguishing attributes and low-complexity detection

Journal in Computer Virology
On detecting active worms with varying scan rate

Computer Communications
A new N-gram feature extraction-selection method for malicious code

ICANNGA'11 Proceedings of the 10th international conference on Adaptive and natural computing algorithms - Volume Part II
Inoculation against malware infection using kernel-level software sensors

Proceedings of the 8th ACM international conference on Autonomic computing
Virtual machine monitor-based lightweight intrusion detection

ACM SIGOPS Operating Systems Review
Cloud-based malware detection for evolving data streams

ACM Transactions on Management Information Systems (TMIS)
Combining file content and file relations for cloud based malware detection

Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining
Opcode-sequence-based semi-supervised unknown malware detection

CISIS'11 Proceedings of the 4th international conference on Computational intelligence in security for information systems
Using RS and SVM to detect new malicious executable codes

RSKT'06 Proceedings of the First international conference on Rough Sets and Knowledge Technology
Using fuzzy pattern recognition to detect unknown malicious executables code

FSKD'05 Proceedings of the Second international conference on Fuzzy Systems and Knowledge Discovery - Volume Part I
An immune concentration based virus detection approach using particle swarm optimization

ICSI'10 Proceedings of the First international conference on Advances in Swarm Intelligence - Volume Part I
A framework for the application of association rule mining in large intrusion detection infrastructures

RAID'06 Proceedings of the 9th international conference on Recent Advances in Intrusion Detection
New malicious code detection using variable length n-grams

ICISS'06 Proceedings of the Second international conference on Information Systems Security
Idea: opcode-sequence-based malware detection

ESSoS'10 Proceedings of the Second international conference on Engineering Secure Software and Systems
A survey of security visualization for computer network logs

Security and Communication Networks
A quantitative study of accuracy in system call-based malware detection

Proceedings of the 2012 International Symposium on Software Testing and Analysis
Mal-ID: automatic malware detection using common segment analysis and meta-features

The Journal of Machine Learning Research
Tracking concept drift in malware families

Proceedings of the 5th ACM workshop on Security and artificial intelligence
A-GHSOM: An adaptive growing hierarchical self organizing map for network anomaly detection

Journal of Parallel and Distributed Computing
Using low-level dynamic attributes for malware detection based on data mining methods

MMM-ACNS'12 Proceedings of the 6th international conference on Mathematical Methods, Models and Architectures for Computer Network Security: computer network security
A comparative study of malware family classification

ICICS'12 Proceedings of the 14th international conference on Information and Communications Security
Opcode sequences as representation of executables for data-mining-based unknown malware detection

Information Sciences: an International Journal
Review: Classification of malware based on integrated static and dynamic features

Journal of Network and Computer Applications
Discriminant malware distance learning on structuralinformation for automated malware classification

Proceedings of the ACM SIGMETRICS/international conference on Measurement and modeling of computer systems
Using file relationships in malware classification

DIMVA'12 Proceedings of the 9th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Discriminant malware distance learning on structural information for automated malware classification

Proceedings of the 19th ACM SIGKDD international conference on Knowledge discovery and data mining
VILO: a rapid learning nearest-neighbor classifier for malware triage

Journal in Computer Virology
Malware detection by pruning of parallel ensembles using harmony search

Pattern Recognition Letters
SigMal: a static signal processing based malware triage

Proceedings of the 29th Annual Computer Security Applications Conference
LSB replacement steganography software detection based on model checking

IWDW'12 Proceedings of the 11th international conference on Digital Forensics and Watermaking
Exploring discriminatory features for automated malware classification

DIMVA'13 Proceedings of the 10th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
A distance sum-based hybrid method for intrusion detection

Applied Intelligence
Design and Implementation of a Data Mining System for Malware Detection

Journal of Integrated Design & Process Science
Detection of cross site scripting attack in wireless networks using n-Gram and SVM

Mobile Information Systems - Advances in Network-Based Information Systems

Quantified Score

Hi-index	0.00

Visualization

Abstract

Abstract: A serious security threat today is malicious executables, especially new, unseen malicious executables often arriving as email attachments. These new malicious executables are created at the rate of thousands every year and pose a serious security threat. Current anti-virus systems attempt to detect these new malicious programs with heuristics generated by hand. This approach is costly and oftentimes ineffective. In this paper, we present a data-mining framework that detects new, previously unseen malicious executables accurately and automatically. The data-mining framework automatically found patterns in our data set and used these patterns to detect a set of new malicious binaries. Comparing our detection methods with a traditional signature-based method, our method more than doubles the current detection rates for new malicious executables.