• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>IEEE Conference on Communications and Network Security >Towards sequencing malicious system calls
【24h】

Towards sequencing malicious system calls

机译：对恶意系统调用进行排序

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

System-call analysis is recognized as one of the most promising approaches to malware detection due to its ability to facilitate detection of malware variants as well as zero-day malware. However, one of the key challenges of system-call based analysis - which prevents it from being used in real-time detection systems - is the excessive size/dimensionality of the system-call sequences that correspond to most current day malware. The main contributions of our work are two-fold: (1) We propose a novel approach to malware system-call sequence representation that ensures more effective detection and analysis of individual malware instances as well as their corresponding malware families. In particular, our approach results in a considerable reduction in the size of system-call sequences of presented software/malware instances, while not falling victim to the so-called “dummy insertion attacks”. (2) Building upon (1), we also propose a novel supervised-learning based framework for detection of malicious system-call sequences in previously unseen software programs. This framework can also be used for effective identification and auditing of benign software programs that are not necessary malicious.
机译：由于系统调用分析能够检测恶意软件变体以及零日恶意软件，因此被认为是最有前途的恶意软件检测方法之一。但是，基于系统调用的分析的主要挑战之一-阻止其在实时检测系统中使用-与当今大多数恶意软件相对应的系统调用序列的大小/维数过大。我们工作的主要贡献有两个方面：（1）我们提出了一种新的恶意软件系统调用序列表示方法，该方法可确保更有效地检测和分析单个恶意软件实例及其对应的恶意软件家族。尤其是，我们的方法可显着减少所呈现的软件/恶意软件实例的系统调用序列的大小，而不会成为所谓的“虚拟插入攻击”的受害者。 （2）在（1）的基础上，我们还提出了一种新颖的基于监督学习的框架，用于检测以前未见过的软件程序中的恶意系统调用序列。该框架还可以用于有效地识别和审核不必要的恶意恶意软件程序。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号