Virus Detection Method based on Behavior Resource Tree
| Autor: | Lansheng Han, Ming Liu, Qiwen Liu, Mengsong Zou |
|---|---|
| Rok vydání: | 2011 |
| Předmět: |
Computer science
media_common.quotation_subject computer.software_genre Signature (logic) Virus detection Computer virus World Wide Web Tree (data structure) Resource (project management) Program behavior Data mining Function (engineering) computer Software Information Systems Block (data storage) media_common |
| Zdroj: | Journal of Information Processing Systems. 7:173-186 |
| ISSN: | 1976-913X |
| DOI: | 10.3745/jips.2011.7.1.173 |
| Popis: | —Due to the disadvantages of signature-based computer virus detection techniques, behavior-based detection methods have developed rapidly in recent years. However, current popular behavior-based detection methods only take API call sequences as program behavior features and the difference between API calls in the detection is not taken into consideration. This paper divides virus behaviors into separate function modules by introducing DLLs into detection. APIs in different modules have different importance. DLLs and APIs are both considered program calling resources. Based on the calling relationships between DLLs and APIs, program calling resources can be pictured as a tree named program behavior resource tree. Important block structures are selected from the tree as program behavior features. Finally, a virus detection model based on behavior the resource tree is proposed and verified by experiment which provides a helpful reference to virus detection. Keywords —Computer Virus, Behavior-Based Detection, Dynamic Link Library, Behavior |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|