DMCA
Opcode sequences as representation of executables for data-mining-based unknown malware detection (2013)
| Venue: | INFORMATION SCIENCES 227 |
| Citations: | 12 - 0 self |
BibTeX
@MISC{Santos13opcodesequences,
author = {Igor Santos and Felix Brezo and Xabier Ugarte-pedrero and Pablo G. Bringas},
title = {Opcode sequences as representation of executables for data-mining-based unknown malware detection},
year = {2013}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Malware can be defined as any type of malicious code that has the potential to harm a computer or network. The volume of malware is growing faster every year and poses a serious global security threat. Consequently, malware detection has become a critical topic in computer security. Currently, signature-based detection is the most widespread method used in commercial antivirus. In spite of the broad use of this method, it can detect malware only after the malicious executable has already caused damage and provided the malware is adequately documented. Therefore, the signature-based method consistently fails to detect new malware. In this paper, we propose a new method to detect unknown malware families. This model is based on the frequency of the appearance of opcode sequences. Furthermore, we describe a technique to mine the relevance of each opcode and assess the frequency of each opcode sequence. In addition, we provide empirical validation that this new method is capable of detecting unknown malware.
Keyphrases
opcode sequence data-mining-based unknown malware detection new method signature-based method new malware empirical vali-dation unknown malware unknown malware family commercial antivirus serious global security threat critical topic computer security signature-based detection broad use widespread method malicious code malware detection
