...
  • 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Future generation computer systems >Similarity hash based scoring of portable executable files for efficient malware detection in IoT
【24h】

Similarity hash based scoring of portable executable files for efficient malware detection in IoT

机译：基于相似性散列的便携式可执行文件评分，以便在IOT中有效恶意软件检测

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

The current rise in malicious attacks shows that existing security systems are bypassed by malicious files. Similarity hashing has been adopted for sample triaging in malware analysis and detection. File similarity is used to cluster malware into families such that their common signature can be designed. This paper explores four hash types currently used in malware analysis for portable executable (PE) files. Although each hashing technique produces interesting results, when applied independently, they have high false detection rates. This paper investigates into a central issue of how different hashing techniques can be combined to provide a quantitative malware score and to achieve better detection rates. We design and develop a novel approach for malware scoring based on the hashes results. The proposed approach is evaluated through a number of experiments. Evaluation clearly demonstrates a significant improvement (＞ 90%) in true detection rates of malware.
机译：恶意攻击的当前增加表明，现有的安全系统被恶意文件绕过。在恶意软件分析和检测中采用样品三脉冲采用了相似性散列。文件相似度用于将恶意软件群集到家庭中，以便设计其常用签名。本文探讨了用于便携式可执行（PE）文件的恶意软件分析中使用的四种哈希类型。虽然每个散列技术都会产生有趣的结果，但在独立应用时，它们具有高误检测率。本文调查了如何组合不同散列技术的核心问题，以提供定量恶意软件评分并实现更好的检测率。我们设计并开发了基于哈希结果的恶意软件评分的新方法。所提出的方法通过许多实验进行评估。评估清楚地证明了恶意软件的真实检测率的显着改善（> 90％）。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号