TY - GEN
T1 - Generating behavior-based malware detection models with genetic programming
AU - Wuchner, Tobias
AU - Ochoa, Martin
AU - Lovat, Enrico
AU - Pretschner, Alexander
N1 - Publisher Copyright:
© 2016 IEEE.
PY - 2016
Y1 - 2016
N2 - Malware remains a major IT security threat and current detection approaches struggle to cope with a professionalized malware development industry. We propose the use of genetic programming to generate effective and robust malware detection models which we call FrankenMods. These are sets of graph metrics that capture characteristic malware behavior. Evolution of FrankenMods with good detection capabilities yields continuously improved detection effectiveness. FrankenMods are operationalized by evaluating them on quantitative data flow graphs that model malware behavior as data flows between system resources caused by issued system calls. We show that FrankenMods are substantially more robust and effective than a state-of-the-art graph metric-based detection approach.
AB - Malware remains a major IT security threat and current detection approaches struggle to cope with a professionalized malware development industry. We propose the use of genetic programming to generate effective and robust malware detection models which we call FrankenMods. These are sets of graph metrics that capture characteristic malware behavior. Evolution of FrankenMods with good detection capabilities yields continuously improved detection effectiveness. FrankenMods are operationalized by evaluating them on quantitative data flow graphs that model malware behavior as data flows between system resources caused by issued system calls. We show that FrankenMods are substantially more robust and effective than a state-of-the-art graph metric-based detection approach.
UR - https://www.scopus.com/pages/publications/85019238677
U2 - 10.1109/PST.2016.7907008
DO - 10.1109/PST.2016.7907008
M3 - Conference contribution
AN - SCOPUS:85019238677
T3 - 2016 14th Annual Conference on Privacy, Security and Trust, PST 2016
SP - 506
EP - 511
BT - 2016 14th Annual Conference on Privacy, Security and Trust, PST 2016
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 14th Annual Conference on Privacy, Security and Trust, PST 2016
Y2 - 12 December 2016 through 14 December 2016
ER -