Behavioral Entropy Towards Detection of Metamorphic Malwares
| Autor: | Mohammad Rashidnejad, Kambiz Vahedi, Khadijeh Afhamisisi, Maghsoud Abbaspour |
|---|---|
| Rok vydání: | 2019 |
| Předmět: |
021110 strategic
defence & security studies Software_OPERATINGSYSTEMS Computer science business.industry 0211 other engineering and technologies Behavioral pattern Pattern recognition 02 engineering and technology computer.file_format computer.software_genre Two stages 020204 information systems 0202 electrical engineering electronic engineering information engineering False positive paradox Malware Entropy (information theory) Statistical analysis Artificial intelligence Executable business computer Metamorphic malware |
| Zdroj: | 2019 9th International Conference on Computer and Knowledge Engineering (ICCKE). |
| DOI: | 10.1109/iccke48569.2019.8964967 |
| Popis: | Recent metamorphic malware detection methods based on statistical analysis of malware code and measuring similarity between codes are by far more superior compared with signature-based detection methods; yet, lacking against code obfuscation methods including insertion of garbage codes similar to benign files and replacing instructions with equivalent instructions. This paper proposes a method on improved detection of metamorphic malwares based on activity and behavior analysis of executable files. The process involves two stages: initially, behavior of the file is analyzed during runtime and the behavioral pattern is obtained; then, in the second stage, behavioral patterns of the malware files are compared with the sample file in order to determine the level of similarity. The stage on analyzing behavior of the file is accomplished in a monitored environment and then malicious behavioral features of the file are extracted. The second stage involves determining level of similarity between malwares registered into the database in the first stage and the sample files. The obtained experimental results show that the proposed method, by determining the similarity level of behavioral patterns, significantly improves detection of metamorphic malwares and along with no false positives. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|