Skip to main content

2012 | OriginalPaper | Buchkapitel

60. Malware Classification Methods Using API Sequence Characteristics

verfasst von : Kyoung-Soo Han, In-Kyoung Kim, Eul Gyu Im

Erschienen in: Proceedings of the International Conference on IT Convergence and Security 2011

Verlag: Springer Netherlands

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

Malware is generated to gain profits by attackers, and it infects many users’ computers. As a result, attackers can acquire private information such as login IDs, passwords, e-mail addresses, cell-phone numbers and banking account numbers from infected machines. Moreover, infected machines can be used for other cyber-attacks such as DDoS attacks, spam e-mail transmissions, and so on. The number of new malware discovered every day is increasing continuously because the automated tools allow attackers to generate the new malware or their variants easily. Therefore, a rapid malware analysis method is required in order to mitigate the infection rate and secondary damage to users. In this paper, we proposed a malware variant classification method using sequential characteristics of API used, and described experiment results with some malware samples.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Literatur
1.
Zurück zum Zitat Petzold C (1998) Programming microsoft windows, 5th edn. Microsoft Press, London Petzold C (1998) Programming microsoft windows, 5th edn. Microsoft Press, London
2.
Zurück zum Zitat Wang M, Zhang C, Yu J (2006) Native API based windows anomaly intrusion detection method using SVM. In: Proceedings of IEEE international conference on sensor networks, ubiquitous, and trustworthy computing, vol 1, pp 514–519 Wang M, Zhang C, Yu J (2006) Native API based windows anomaly intrusion detection method using SVM. In: Proceedings of IEEE international conference on sensor networks, ubiquitous, and trustworthy computing, vol 1, pp 514–519
3.
Zurück zum Zitat Hoglund G, Butler J (2005) Rootkits: subverting the windows kernel. Addison-Wesley, Reading Hoglund G, Butler J (2005) Rootkits: subverting the windows kernel. Addison-Wesley, Reading
4.
Zurück zum Zitat Willems C, Holz T, Freiling F (2007) Toward automated dynamic malware analysis using CWSandbox. IEEE Secur Privacy 5(2):32–39CrossRef Willems C, Holz T, Freiling F (2007) Toward automated dynamic malware analysis using CWSandbox. IEEE Secur Privacy 5(2):32–39CrossRef
5.
Zurück zum Zitat Park N, Kim Y, Noh B (2006) A behavior based detection for malicious code using obfuscation technique. J KIISC 16(3):17–28 Park N, Kim Y, Noh B (2006) A behavior based detection for malicious code using obfuscation technique. J KIISC 16(3):17–28
6.
Zurück zum Zitat Fredrikson M, Jha S, Christodorescu M, Sailer R, Yan X (2010) Synthesizing near-optimal malware specifications from suspicious behaviors. In: Proceedings of the 2010 IEEE symposium on security and privacy, pp 45–60 Fredrikson M, Jha S, Christodorescu M, Sailer R, Yan X (2010) Synthesizing near-optimal malware specifications from suspicious behaviors. In: Proceedings of the 2010 IEEE symposium on security and privacy, pp 45–60
7.
Zurück zum Zitat Miao Q, Wang Y, Cao Y, Zhang X, Liu Z (2010) APICapture—a tool for monitoring the behavior of malware. In: Proceedings of the 3rd international conference on advanced computer theory and engineering, pp 390–394 Miao Q, Wang Y, Cao Y, Zhang X, Liu Z (2010) APICapture—a tool for monitoring the behavior of malware. In: Proceedings of the 3rd international conference on advanced computer theory and engineering, pp 390–394
8.
Zurück zum Zitat Nair VP, Jain H, Golecha YK, Gaur MS, Laxmi V (2010) MEDUSA: metamorphic malware dynamic analysis using signature from API. In: Proceedings of the 3rd international conference on security of information and networks, pp 263–269 Nair VP, Jain H, Golecha YK, Gaur MS, Laxmi V (2010) MEDUSA: metamorphic malware dynamic analysis using signature from API. In: Proceedings of the 3rd international conference on security of information and networks, pp 263–269
9.
Zurück zum Zitat Lee J, Jeong K, Lee H (2010) Detecting metamorphic malwares using code graphs. In: Proceedings of the 2010 ACM symposium on applied computing, pp 1970–1977 Lee J, Jeong K, Lee H (2010) Detecting metamorphic malwares using code graphs. In: Proceedings of the 2010 ACM symposium on applied computing, pp 1970–1977
10.
Zurück zum Zitat Cesare S, Xiang Y (2010) A fast flowgraph based classification system for packed and polymorphic malware on the endhost. In: Proceedings of the 24th IEEE international conference on advanced information networking and applications, pp 721–728 Cesare S, Xiang Y (2010) A fast flowgraph based classification system for packed and polymorphic malware on the endhost. In: Proceedings of the 24th IEEE international conference on advanced information networking and applications, pp 721–728
11.
Zurück zum Zitat Zhang Q, Reeves DS (2007) MetaAware: identifying metamorphic malware. In: Proceedings of the 23rd annual computer security applications conference, pp 411–420 Zhang Q, Reeves DS (2007) MetaAware: identifying metamorphic malware. In: Proceedings of the 23rd annual computer security applications conference, pp 411–420
12.
Zurück zum Zitat Karnik A, Goswami S, RGuha R (2007) Detecting obfuscated viruses using cosine similarity analysis. In: Proceedings of the 1th Asia international conference on modelling and simulation, pp 165–170 Karnik A, Goswami S, RGuha R (2007) Detecting obfuscated viruses using cosine similarity analysis. In: Proceedings of the 1th Asia international conference on modelling and simulation, pp 165–170
13.
Zurück zum Zitat Cha SK, Moraru I, Jang J, Truelove J, Brumley D, Andersen DG (2010) SplitScreen: enabling efficient, distributed malware detection. In: Proceedings of the 7th USENIX conference on networked systems design and implementation Cha SK, Moraru I, Jang J, Truelove J, Brumley D, Andersen DG (2010) SplitScreen: enabling efficient, distributed malware detection. In: Proceedings of the 7th USENIX conference on networked systems design and implementation
16.
Zurück zum Zitat Han KS, Kim IK, Im EG (2011) Malware family classification method using API sequential characteristic. J JSE 8(2):319–335 Han KS, Kim IK, Im EG (2011) Malware family classification method using API sequential characteristic. J JSE 8(2):319–335
Metadaten
Titel
Malware Classification Methods Using API Sequence Characteristics
verfasst von
Kyoung-Soo Han
In-Kyoung Kim
Eul Gyu Im
Copyright-Jahr
2012
Verlag
Springer Netherlands
DOI
https://doi.org/10.1007/978-94-007-2911-7_60

Neuer Inhalt