DMCA
Automated classification and analysis of internet malware (2007)
Cached
Download Links
| Venue: | In Proceedings of Recent Advances in Intrusion Detection (RAID’07 |
| Citations: | 105 - 5 self |
BibTeX
@TECHREPORT{Bailey07automatedclassification,
author = {Michael Bailey and Jon Andersen and Z. Morleymao and Farnam Jahanian},
title = {Automated classification and analysis of internet malware},
institution = {In Proceedings of Recent Advances in Intrusion Detection (RAID’07},
year = {2007}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Abstract. Numerous attacks, such as worms, phishing, and botnets, threaten the availability of the Internet, the integrity of its hosts, and the privacy of its users. A core element of defense against these attacks is anti-virus (AV) software—a service that detects, removes, and characterizes these threats. The ability of these products to successfully characterize these threats has far-reaching effects—from facilitating sharing across organizations, to detecting the emergence of new threats, and assessing risk in quarantine and cleanup. In this paper, we examine the ability of existing host-based anti-virus products to provide semantically meaningful information about the malicious software and tools (or malware) used by attackers. Using a large, recent collection of malware that spans a variety of attack vectors (e.g., spyware, worms, spam), we show that different AV products characterize malware in ways that are inconsistent across AV products, incomplete across malware, and that fail to be concise in their semantics. To address these limitations, we propose a new classification technique that describes malware behavior in terms of system state changes (e.g., files written, processes created) rather than in sequences or patterns of system calls. To address the sheer volume of malware and diversity of its behavior, we provide a method for automatically categorizing these profiles of malware into groups that reflect similar classes of behaviors and demonstrate how behavior-based clustering provides a more direct and effective way of classifying and analyzing Internet malware. 1
Keyphrases
internet malware different av product effective way recent collection behavior-based clustering far-reaching effect malicious software attack vector numerous attack new threat system state change host-based anti-virus product malware behavior av product new classification technique core element similar class sheer volume meaningful information
