Automated malware detection using artifacts in forensic memory images

R Mosli, R Li, B Yuan, Y Pan - 2016 IEEE Symposium on …, 2016 - ieeexplore.ieee.org
2016 IEEE Symposium on Technologies for Homeland Security (HST), 2016ieeexplore.ieee.org
Malware is one of the greatest and most rapidly growing threats to the digital world.
Traditional signature-based detection is no longer adequate to detect new variants and
highly targeted malware. Furthermore, dynamic detection is often circumvented with anti-VM
and/or anti-debugger techniques. Recently heuristic approaches have been explored to
enhance detection accuracy while maintaining the generality of a model to detect unknown
malware samples. In this paper, we investigate three feature types extracted from memory …
Malware is one of the greatest and most rapidly growing threats to the digital world. Traditional signature-based detection is no longer adequate to detect new variants and highly targeted malware. Furthermore, dynamic detection is often circumvented with anti-VM and/or anti-debugger techniques. Recently heuristic approaches have been explored to enhance detection accuracy while maintaining the generality of a model to detect unknown malware samples. In this paper, we investigate three feature types extracted from memory images - registry activity, imported libraries, and API function calls. After evaluating the importance of the different features, different machine learning techniques are implemented to compare performances of malware detection using the three feature types, respectively. The highest accuracy achieved was 96%, and was reached using a support vector machine model, fitted on data extracted from registry activity.
ieeexplore.ieee.org
以上显示的是最相近的搜索结果。 查看全部搜索结果