Malware Detection Based on Suspicious Behavior Identification
Authors:
- Cheng WangCWCheng Wang
- Jianmin PangJPJianmin Pang
- Rongcai ZhaoRZRongcai Zhao
- Wen FuWFWen Fu
- Xiaoxian LiuXLXiaoxian Liu
- 1 January 2009
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- Vol. 2, 198-202
Abstract
Along with the popularization of computers, especially the wide use of Internet, malicious code in recent years has presented a serious threat to our world. In this paper, through the analysis against the suspicious behaviors of vicious program by function calls, we present an approach of malware detection which is based on analysis and distilling of representative characteristic and systemic description of the suspicious behaviors indicated by the sequences of APIs called under Windows. Based on function calls and control flow analysis, according to the identification of suspicious behavior, the technique implements a strategy of detection from malicious binary executables.Keywords
This publication has 3 references indexed in Scilit:
- Using Support Vector Machine to Detect Unknown Computer VirusesInternational Journal of Computational Intelligence Research, 2006
- Data mining methods for detection of new malicious executables2002
- Intraprocedural static slicing of binary executables1997