DMCA
Embedded Malware Detection using Markov n-grams (2008)
| Venue: | Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA |
| Citations: | 20 - 3 self |
BibTeX
@INPROCEEDINGS{Shafiq08embeddedmalware,
author = {M. Zubair Shafiq and Syed Ali Khayam and Muddassar Farooq},
title = {Embedded Malware Detection using Markov n-grams},
booktitle = {Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA},
year = {2008},
pages = {88--107}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Abstract. Embedded malware is a recently discovered security threat that allows malcode to be hidden inside a benign file. It has been shown that embedded malware is not detected by commercial antivirus software even when the malware signature is present in the antivirus database. In this paper, we present a novel anomaly detection scheme to detect embedded malware. We first analyze byte sequences in benign files to show that benign files ’ data generally exhibit a 1-st order dependence structure. Consequently, conditional n-grams provide a more meaningful representation of a file’s statistical properties than traditional n-grams. To capture and leverage this correlation structure for embedded malware detection, we model the conditional distributions asMarkov n-grams. For embedded malware detection, we use an information-theoretic measure, called entropy rate, to quantify changes in Markov n-gram distributions observed in a file. We show that the entropy rate of Markov n-grams gets significantly perturbed at malcode embedding locations, and there-fore can act as a robust feature for embedded malware detection. We evaluate the proposed Markov n-gram detector on a comprehensive mal-ware dataset consisting of more than 37, 000 malware samples and 1, 800 benign samples of six well-known filetypes. We show that the Markov n-gram detector provides better detection and false positive rates than the only existing embedded malware detection scheme. 1
Keyphrases
malware detection embedded malware detection embedded malware entropy rate benign file markov n-gram detector malware signature byte sequence benign file data comprehensive mal-ware dataset consisting conditional distribution information-theoretic measure markov n-gram distribution robust feature novel anomaly detection scheme conditional n-grams provide file statistical property commercial antivirus software meaningful representation well-known filetypes false positive rate benign sample 1-st order dependence structure security threat malware detection scheme malware sample correlation structure antivirus database
