Virus Detection Method based on Behavior Resource Tree
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
Due to the disadvantages of signature-based computer virus detection techniques, behavior-based detection methods have developed rapidly in recent years. However, current popular behavior-based detection methods only take API call sequences as program behavior features and the difference between API calls in the detection is not taken into consideration. This paper divides virus behaviors into separate function modules by introducing DLLs into detection. APIs in different modules have different importance. DLLs and APIs are both considered program calling resources. Based on the calling relationships between DLLs and APIs, program calling resources can be pictured as a tree named program behavior resource tree. Important block structures are selected from the tree as program behavior features. Finally, a virus detection model based on behavior the resource tree is proposed and verified by experiment which provides a helpful reference to virus detection.
Abstract
Due to the disadvantages of signature-based computer virus detection techniques, behavior-based detection methods have developed rapidly in recent years. However, current popular behavior-based detection methods only take API call sequences as program behavior features and the difference between API calls in the detection is not taken into consideration. This paper divides virus behaviors into separate function modules by introducing DLLs into detection. APIs in different modules have different importance. DLLs and APIs are both considered program calling resources. Based on the calling relationships between DLLs and APIs, program calling resources can be pictured as a tree named program behavior resource tree. Important block structures are selected from the tree as program behavior features. Finally, a virus detection model based on behavior the resource tree is proposed and verified by experiment which provides a helpful reference to virus detection.
참고문헌 (10)
- Jeffrey O. Kephart, "Automatic Extraction of Computer Virus Signatures", 4th Virus Bulletin International Conference, Jersey, USA, pp.178~184 (1994)
- Matthew G. Schultz, "Data Mining Methods for Detection of New Malicious Executables", IEEE Symposium on security and privacy, pp.38~49 (2001)
- Jeremy Z. Kolter, "Learning to Detect Malicious Executables in the Wild", Proceedings of the tenth ACM SIGKDD international conference, pp.2721~2744 (2004)
- David Wagner, "Intrusion Detection via Static Analysis", Proceedings of the IEEE Symposium on Security and Privacy, pp.156~168 (2001)
- J-Y. Xu, "Polymorphic Malicious Executable Scanner by API Sequence Analysis", Proceedings of the Fourth International Conference on Hybrid Intelligent Systems, pp.378~383 (2004)
- J. Bergeron, "Detection of Malicious Code in Executable Programs", Int. J. of Req. Eng, pp.45~48 (2001)
- XU Ming, "Anomaly Detection Based on System Call Classification", Journal of Software, 15(3), pp.391~403 (2004)
- Elizabeth Stinson, "Characterizing Bots’ Remote Control Behavior. In Detection of Intrusions & Malware, and Vulnerability Assessment", 89~108 (2007)
- Essam Al Daoud, "Computer Virus Strategies and Detection Methods", Int. J. Open Problems Compt. Math, 1(2), pp.12~20 (2008)
- F. Cohen, "Computer viruses:: Theory and experiments", Computers & security, 6, pp.22~23 (1987)