Abstract
Traditionally, analysis of malicious software is only a semi-automated process, often requiring a skilled human analyst. As new malware appears at an increasingly alarming rate - now over 100 thousand new variants each day - there is a need for automated techniques for identifying suspicious behavior in programs. In this paper, we propose a method for extracting statistically significant malicious behaviors from a system call dependency graph (obtained by running a binary executable in a sandbox). Our approach is based on a new method for measuring the statistical significance of subgraphs. Given a training set of graphs from two classes (e.g., goodware and malware system call dependency graphs), our method can assign p-values to subgraphs of new graph instances even if those subgraphs have not appeared before in the training data (thus possibly capturing new behaviors or disguised versions of existing behaviors).
| Original language | English (US) |
|---|---|
| Title of host publication | Proceedings - 29th Annual Computer Security Applications Conference, ACSAC 2013 |
| Pages | 69-78 |
| Number of pages | 10 |
| DOIs | |
| State | Published - Dec 1 2013 |
| Event | 29th Annual Computer Security Applications Conference, ACSAC 2013 - New Orleans, LA, United States Duration: Dec 9 2013 → Dec 13 2013 |
Publication series
| Name | ACM International Conference Proceeding Series |
|---|
Other
| Other | 29th Annual Computer Security Applications Conference, ACSAC 2013 |
|---|---|
| Country | United States |
| City | New Orleans, LA |
| Period | 12/9/13 → 12/13/13 |
Fingerprint
All Science Journal Classification (ASJC) codes
- Software
- Human-Computer Interaction
- Computer Vision and Pattern Recognition
- Computer Networks and Communications
Cite this
}
Extraction of statistically significant malware behaviors. / Palahan, Sirinda; Babic, Domagoj; Chaudhuri, Swarat; Kifer, Daniel.
Proceedings - 29th Annual Computer Security Applications Conference, ACSAC 2013. 2013. p. 69-78 (ACM International Conference Proceeding Series).Research output: Chapter in Book/Report/Conference proceeding › Conference contribution
TY - GEN
T1 - Extraction of statistically significant malware behaviors
AU - Palahan, Sirinda
AU - Babic, Domagoj
AU - Chaudhuri, Swarat
AU - Kifer, Daniel
PY - 2013/12/1
Y1 - 2013/12/1
N2 - Traditionally, analysis of malicious software is only a semi-automated process, often requiring a skilled human analyst. As new malware appears at an increasingly alarming rate - now over 100 thousand new variants each day - there is a need for automated techniques for identifying suspicious behavior in programs. In this paper, we propose a method for extracting statistically significant malicious behaviors from a system call dependency graph (obtained by running a binary executable in a sandbox). Our approach is based on a new method for measuring the statistical significance of subgraphs. Given a training set of graphs from two classes (e.g., goodware and malware system call dependency graphs), our method can assign p-values to subgraphs of new graph instances even if those subgraphs have not appeared before in the training data (thus possibly capturing new behaviors or disguised versions of existing behaviors).
AB - Traditionally, analysis of malicious software is only a semi-automated process, often requiring a skilled human analyst. As new malware appears at an increasingly alarming rate - now over 100 thousand new variants each day - there is a need for automated techniques for identifying suspicious behavior in programs. In this paper, we propose a method for extracting statistically significant malicious behaviors from a system call dependency graph (obtained by running a binary executable in a sandbox). Our approach is based on a new method for measuring the statistical significance of subgraphs. Given a training set of graphs from two classes (e.g., goodware and malware system call dependency graphs), our method can assign p-values to subgraphs of new graph instances even if those subgraphs have not appeared before in the training data (thus possibly capturing new behaviors or disguised versions of existing behaviors).
UR - http://www.scopus.com/inward/record.url?scp=84893321191&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84893321191&partnerID=8YFLogxK
U2 - 10.1145/2523649.2523659
DO - 10.1145/2523649.2523659
M3 - Conference contribution
SN - 9781450320153
T3 - ACM International Conference Proceeding Series
SP - 69
EP - 78
BT - Proceedings - 29th Annual Computer Security Applications Conference, ACSAC 2013
ER -