260 0

Extracting representative API patterns of malware families using multiple sequence alignments

Title
Extracting representative API patterns of malware families using multiple sequence alignments
Author
임을규
Keywords
Multiple Sequence Alignment; Malware classification; Representative API pattern
Issue Date
2015-10
Publisher
ACM
Citation
Proceeding of the 2015 Research in Adaptive and Convergent Systems, RACS 2015 9 October 2015, Page. 308-313
Abstract
Nowadays malware developers use various techniques to avoid detection of antivirus software. For variants of malware, existing signature based detection method could be avoidable because those have some differences in static information like code or strings. Therefore, to detect and classify malware variants, a behavior based detection is required. This paper proposes a technique to extract a representative API pattern from API call sequences of a malware family using multiple sequence alignment (MSA) algorithm to measure similarities among malware variants. To extract API call sequences of malware, a sandbox tool was used. After that, the Clustal algorithm, a popular MSA algorithm used in the Bioinformatics field, was applied to malware API call sequences, and the representative API pattern was extracted from the results of MSA. Experiments to test the extracted API patterns that are used to classify malware variants were carried out, and we measured classification accuracy of the representative API pattern of each family. The experimental results show that our proposed method can be effective to classify malware families. © 2015 ACM.
URI
http://dl.acm.org/citation.cfm?doid=2811411.2811543http://hdl.handle.net/20.500.11754/28246
ISBN
978-1-4503-3738-0
DOI
10.1145/2811411.2811543
Appears in Collections:
COLLEGE OF ENGINEERING[S](공과대학) > COMPUTER SCIENCE AND ENGINEERING(컴퓨터공학부) > Articles
Files in This Item:
There are no files associated with this item.
Export
RIS (EndNote)
XLS (Excel)
XML


qrcode

Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.

BROWSE