Malware Detection using Attribute-Automata to parse Abstract Behavioral Descriptions

Details Malware Detection using Attribute-Automata to parse Abstract Behavioral Descriptions Malware Detection using Attribute-Automata to parse Abstract Behavioral Descriptions

2009-02-02

arxiv.org/abs/0902.0322v1

Computer Science

Cryptography and Security

Scientific paper

Most behavioral detectors of malware remain specific to a given language and platform, mostly PE executables for Windows. The objective of this paper is to define a generic approach for behavioral detection based on two layers respectively responsible for abstraction and detection. The first abstraction layer remains specific to a platform and a language. This first layer interprets the collected instructions, API calls and arguments and classifies these operations as well as the involved objects according to their purpose in the malware lifecycle. The second detection layer remains generic and is totally interoperable between the different abstraction components. This layer relies on parallel automata parsing attribute-grammars where semantic rules are used for object typing (object classification) and object binding (data-flow). To feed detection and to experiment with our approach we have developed two different abstraction components: one processing system call traces from native code and one processing the VBScript interpreted language. The different experimentations have provided promising detection rates, in particular for script files (89%), with almost none false positives. In the case of process traces, the detection rate remains significant (51%) but could be increased by more sophisticated collection tools.

Affiliated with

Also associated with

No associations

Rating

Malware Detection using Attribute-Automata to parse Abstract Behavioral Descriptions does not yet have a rating. At this time, there are no reviews or comments for this scientific paper.

If you have personal experience with Malware Detection using Attribute-Automata to parse Abstract Behavioral Descriptions, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Malware Detection using Attribute-Automata to parse Abstract Behavioral Descriptions will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFWR-SCP-O-160170