[PDF][PDF] A malware detection framework based on Kolmogorov complexity

W Deng, Q Liu, H Cheng, Z Qin - Journal of Computational Information …, 2011 - Citeseer
W Deng, Q Liu, H Cheng, Z Qin
Journal of Computational Information Systems, 2011Citeseer
Malware has been posing a major threat for computer systems. The huge amount and
diversity of its variants, such as computer viruses, Internet worms and Trojan horses, render
classic security defenses ineffective. For the existence of active adversaries which constantly
attempt to evade anti-malware, traditional signature-based approaches fail to detect
malware which is new or obfuscated. This paper presents a general malware detection
framework based on Kolmogorov complexity. As an example, we use a statistical data …
Abstract
Malware has been posing a major threat for computer systems. The huge amount and diversity of its variants, such as computer viruses, Internet worms and Trojan horses, render classic security defenses ineffective. For the existence of active adversaries which constantly attempt to evade anti-malware, traditional signature-based approaches fail to detect malware which is new or obfuscated. This paper presents a general malware detection framework based on Kolmogorov complexity. As an example, we use a statistical data compression model which is Dynamic Markov Compression (DMC) to classify a code instance either as a “malware” or “benign” code instance. Our preliminary results are very promising. Our experimental results also demonstrate the framework can effectively detect unknown and obfuscated malware with high quality.
Citeseer
以上显示的是最相近的搜索结果。 查看全部搜索结果