Malware detection with quantitative data flow graphs

Tobias Wüchner; Martín Ochoa; Alexander Pretschner

doi:10.1145/2590296.2590319

Malware detection with quantitative data flow graphs

Tobias Wüchner, Martín Ochoa, Alexander Pretschner

Informatics 4 - Chair of Software und Systems Engineering

Technical University of Munich

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

50 Scopus citations

Abstract

We propose a novel behavioral malware detection approach based on a generic system-wide quantitative data flow model. We base our data flow analysis on the incremental construction of aggregated quantitative data flow graphs. These graphs represent communication between different system entities such as processes, sockets, files or system registries. We demonstrate the feasibility of our approach through a prototypical instantiation and implementation for the Windows operating system. Our experiments yield encouraging results: in our data set of samples from common malware families and popular non-malicious applications, our approach has a detection rate of 96 % and a false positive rate of less than 1.6 %.

Original language	English
Title of host publication	ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security
Publisher	Association for Computing Machinery, Inc
Pages	271-282
Number of pages	12
ISBN (Electronic)	9781450328005
DOIs	https://doi.org/10.1145/2590296.2590319
State	Published - 4 Jun 2014
Event	9th ACM Symposium on Information, Computer and Communications Security, ASIA CCS 2014 - Kyoto, Japan Duration: 4 Jun 2014 → 6 Jun 2014

Publication series

Name	ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security

Conference

Conference	9th ACM Symposium on Information, Computer and Communications Security, ASIA CCS 2014
Country/Territory	Japan
City	Kyoto
Period	4/06/14 → 6/06/14

Keywords

Behavioral malware analysis
Data flow tracking
Intrusion detection
Malware detection
Quantitative data flows

Access to Document

10.1145/2590296.2590319

Cite this

Wüchner, T., Ochoa, M., & Pretschner, A. (2014). Malware detection with quantitative data flow graphs. In ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security (pp. 271-282). (ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security). Association for Computing Machinery, Inc. https://doi.org/10.1145/2590296.2590319

Wüchner, Tobias ; Ochoa, Martín ; Pretschner, Alexander. / Malware detection with quantitative data flow graphs. ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security. Association for Computing Machinery, Inc, 2014. pp. 271-282 (ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security).

@inproceedings{16cd304c4b784dbeb3271eb5ca0ab55e,

title = "Malware detection with quantitative data flow graphs",

abstract = "We propose a novel behavioral malware detection approach based on a generic system-wide quantitative data flow model. We base our data flow analysis on the incremental construction of aggregated quantitative data flow graphs. These graphs represent communication between different system entities such as processes, sockets, files or system registries. We demonstrate the feasibility of our approach through a prototypical instantiation and implementation for the Windows operating system. Our experiments yield encouraging results: in our data set of samples from common malware families and popular non-malicious applications, our approach has a detection rate of 96 % and a false positive rate of less than 1.6 %.",

keywords = "Behavioral malware analysis, Data flow tracking, Intrusion detection, Malware detection, Quantitative data flows",

author = "Tobias W{\"u}chner and Mart{\'i}n Ochoa and Alexander Pretschner",

note = "Publisher Copyright: Copyright {\textcopyright} 2014 ACM.; 9th ACM Symposium on Information, Computer and Communications Security, ASIA CCS 2014 ; Conference date: 04-06-2014 Through 06-06-2014",

year = "2014",

month = jun,

day = "4",

doi = "10.1145/2590296.2590319",

language = "English",

series = "ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security",

publisher = "Association for Computing Machinery, Inc",

pages = "271--282",

booktitle = "ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security",

}

Wüchner, T, Ochoa, M & Pretschner, A 2014, Malware detection with quantitative data flow graphs. in ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security. ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security, Association for Computing Machinery, Inc, pp. 271-282, 9th ACM Symposium on Information, Computer and Communications Security, ASIA CCS 2014, Kyoto, Japan, 4/06/14. https://doi.org/10.1145/2590296.2590319

Malware detection with quantitative data flow graphs. / Wüchner, Tobias; Ochoa, Martín; Pretschner, Alexander.
ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security. Association for Computing Machinery, Inc, 2014. p. 271-282 (ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Malware detection with quantitative data flow graphs

AU - Wüchner, Tobias

AU - Ochoa, Martín

AU - Pretschner, Alexander

PY - 2014/6/4

Y1 - 2014/6/4

N2 - We propose a novel behavioral malware detection approach based on a generic system-wide quantitative data flow model. We base our data flow analysis on the incremental construction of aggregated quantitative data flow graphs. These graphs represent communication between different system entities such as processes, sockets, files or system registries. We demonstrate the feasibility of our approach through a prototypical instantiation and implementation for the Windows operating system. Our experiments yield encouraging results: in our data set of samples from common malware families and popular non-malicious applications, our approach has a detection rate of 96 % and a false positive rate of less than 1.6 %.

AB - We propose a novel behavioral malware detection approach based on a generic system-wide quantitative data flow model. We base our data flow analysis on the incremental construction of aggregated quantitative data flow graphs. These graphs represent communication between different system entities such as processes, sockets, files or system registries. We demonstrate the feasibility of our approach through a prototypical instantiation and implementation for the Windows operating system. Our experiments yield encouraging results: in our data set of samples from common malware families and popular non-malicious applications, our approach has a detection rate of 96 % and a false positive rate of less than 1.6 %.

KW - Behavioral malware analysis

KW - Data flow tracking

KW - Intrusion detection

KW - Malware detection

KW - Quantitative data flows

UR - http://www.scopus.com/inward/record.url?scp=84984905603&partnerID=8YFLogxK

U2 - 10.1145/2590296.2590319

DO - 10.1145/2590296.2590319

M3 - Conference contribution

AN - SCOPUS:84984905603

T3 - ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security

SP - 271

EP - 282

BT - ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security

PB - Association for Computing Machinery, Inc

T2 - 9th ACM Symposium on Information, Computer and Communications Security, ASIA CCS 2014

Y2 - 4 June 2014 through 6 June 2014

ER -

Wüchner T, Ochoa M, Pretschner A. Malware detection with quantitative data flow graphs. In ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security. Association for Computing Machinery, Inc. 2014. p. 271-282. (ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security). doi: 10.1145/2590296.2590319

Malware detection with quantitative data flow graphs

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this