• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>IEEE Conference on Communications and Network Security >Towards sequencing malicious system calls
【24h】

Towards sequencing malicious system calls

机译：朝着测序恶意系统调用

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

System-call analysis is recognized as one of the most promising approaches to malware detection due to its ability to facilitate detection of malware variants as well as zero-day malware. However, one of the key challenges of system-call based analysis - which prevents it from being used in real-time detection systems - is the excessive size/dimensionality of the system-call sequences that correspond to most current day malware. The main contributions of our work are two-fold: (1) We propose a novel approach to malware system-call sequence representation that ensures more effective detection and analysis of individual malware instances as well as their corresponding malware families. In particular, our approach results in a considerable reduction in the size of system-call sequences of presented software/malware instances, while not falling victim to the so-called “dummy insertion attacks”. (2) Building upon (1), we also propose a novel supervised-learning based framework for detection of malicious system-call sequences in previously unseen software programs. This framework can also be used for effective identification and auditing of benign software programs that are not necessary malicious.
机译：系统呼叫分析被识别为恶意软件检测的最有希望的方法之一，因为它有助于检测恶意软件变体以及零日恶意软件。然而，基于系统呼叫的分析的关键挑战之一 - 这可以防止其用于实时检测系统 - 是系统呼叫序列的过度尺寸/维度，其对应于大多数当天恶意软件。我们的工作的主要贡献是两倍：（1）我们提出了一种新的恶意软件系统呼叫序列表示方法，可确保更有效的检测和分析单个恶意软件实例以及它们对应的恶意软件系列。特别是，我们的方法导致呈现的软件/恶意软件实例的系统呼叫序列大小相当减少，同时不会将受害者降低到所谓的“虚拟插入攻击”。 （2）建立（1），我们还提出了一种新的监督学习基于学习的框架，用于检测以前看不见的软件程序中的恶意系统呼叫序列。该框架还可用于对不需要恶意的良性软件程序的有效识别和审计。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号