EICAR 2005 Conference: Best Paper Proceedings
نویسندگان
چکیده
Construction of malware phylogeny could help in analyzing new malware samples as they arrive. However, the generated phylogenies must be accurate and be able to contend with the changes and obfuscations the malware writers create in the codes. We present our approach of using maximal πpattern, a PQ tree based feature, as a basis for comparing and classifying malwares. We argue that the πpattern approach is capable of dealing with certain obfuscations imposed in malware evolution process and demonstrate this possibility using examples of known viruses. We also suggest this scheme be used for automated naming of malware variants.
منابع مشابه
EICAR 2005 Conference: Best Paper Proceedings
This paper presents a tool for detecting attacks against web server, using the analysis of web server log files. The main characteristic of this tool is its accuracy, being able to carefully graduate its analysis according to the actual success of the attacker. This capability is based on the design of a simple yet powerful signature definition language. We demonstrate the accuracy of the tool ...
متن کاملProceedings of the 6th International Conference on Science and Social Research (CSSR)(Malaysia)
متن کامل
Proceedings of the First MEFOMP International Conference of Medical Physics: November 2-4, 2011, Shiraz, Iran
متن کامل
Test Files and Product Evaluation: the Case for and against Malware Simulation
Any researcher with the most modest public profile is used to being asked for virus samples. Traditionally, we’ve advocated the use of alternatives, especially the EICAR test file, to anyone who doesn’t have access to malware through mainstream, trusted channels, as a way of simulating malware behaviour without the attendant risks of genuinely malicious behaviour. But is the EICAR file really s...
متن کاملAn Intrusion-Detection System Based on the Teiresias Pattern- Discovery Algorithm
This paper addresses the problem of creating a pattern table that can be used to model the normal behavior of a given process. The model can be used for intrusiondetection purposes. So far, most of the approaches proposed have been based on fixed-length patterns, although variable-length patterns seem to be more naturally suited to model the normal process behavior. We have developed a novel te...
متن کامل