Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Detecting Scareware by Mining Variable Length Instruction Sequences
Responsible organisation
2011 (English)Conference paper, Published paper (Refereed) Published
Abstract [en]

Scareware is a recent type of malicious software that may pose financial and privacy-related threats to novice users. Traditional countermeasures, such as anti-virus software, require regular updates and often lack the capability of detecting novel (unseen) instances. This paper presents a scareware detection method that is based on the application of machine learning algorithms to learn patterns in extracted variable length opcode sequences derived from instruction sequences of binary files. The patterns are then used to classify software as legitimate or scareware but they may also reveal interpretable behavior that is unique to either type of software. We have obtained a large number of real world scareware applications and designed a data set with 550 scareware instances and 250 benign instances. The experimental results show that several common data mining algorithms are able to generate accurate models from the data set. The Random Forest algorithm is shown to outperform the other algorithms in the experiment. Essentially, our study shows that, even though the differences between scareware and legitimate software are subtler than between, say, viruses and legitimate software, the same type of machine learning approach can be used in both of these dissimilar cases.

Place, publisher, year, edition, pages
Johannesburg: IEEE Press , 2011.
Keywords [en]
Scareware, Instruction Sequences, Classification
National Category
Computer Sciences
Identifiers
URN: urn:nbn:se:bth-7464Local ID: oai:bth.se:forskinfo7F7D2C29F6FBC1E9C12578FC0035D21DISBN: 978-1-4577-1482-5 (print)OAI: oai:DiVA.org:bth-7464DiVA, id: diva2:835086
Conference
Information Security for South Africa
Available from: 2012-09-18 Created: 2011-08-30 Last updated: 2024-01-09Bibliographically approved
In thesis
1. Automated Malware Detection and Classification Using Supervised Learning
Open this publication in new window or tab >>Automated Malware Detection and Classification Using Supervised Learning
2024 (English)Doctoral thesis, comprehensive summary (Other academic)
Abstract [en]

Malware has been one of the key concerns for Information Technology security researchers for decades. Every year, anti-malware companies release alarming statistics suggesting a continuous increase in the number and types of malware.  This is mainly due to the constant development of new and more sophisticated malicious functionalities, propagation vectors, and infection tactics for malware. To combat this ever-evolving threat, anti-malware companies analyze thousands of malicious samples on a daily basis, either manually or through semi-automated means, to identify their type (whether it's a variant or zero-day) and family. After the analysis, signature databases or rule databases of anti-malware products are updated in order to detect known malware.  However, due to the ever-growing capabilities of malware, the malware analysis process is challenging and requires significant human effort. As a result, researchers are focusing on data-driven approaches based on machine learning to develop intelligent malware detectors with high accuracy. Specifically, they are focused on extracting static features from malware in the form of n-grams for experimental purposes. However, the previous research is inconclusive in terms of optimal feature representation and detection accuracy.

The primary objective of this thesis is to present state-of-the-art automated techniques for detecting and classifying malware using supervised learning algorithms. In particular, the focus is on two critical aspects of supervised learning-based malware detection: optimal feature representation and improved detection accuracy. Malware detection can be accomplished using two methods: static analysis, which extracts patterns without executing malware, and dynamic analysis, which captures behaviors through executing malware. This thesis focuses on static analysis instead of dynamic analysis because static analysis requires fewer computing resources. An additional benefit of static analysis is that present-day malware cannot evade it. To achieve the goals of this thesis, two new feature representations for static analysis are proposed. Furthermore, three customized ensembles are introduced to enhance malware detection accuracy, and their feasibility is experimentally demonstrated.  

The experiments incorporate customized malware data sets including Spyware, Adware, Scareware, and Android malware samples, and public malware data sets from Microsoft's having samples from nine distinct malware families. Artificially generated data sets are employed to mitigate class imbalance issues and represent inter-family and intra-family examples. Reverse engineering is performed to transform the data sets as feature data sets using both byte code and assembly language instructions. Further, existing and new feature representations along with various feature selection algorithms and feature fusion techniques are explored. To enhance detection accuracy, different decision theories from social choice theory, such as veto and consensus, are integrated into customized ensembles. The experimental results indicate that the proposed methods are capable of detecting known and zero-day malware. The proposed ensembles are also tested on the UCI public data sets, such as Forest CoverType, and the results demonstrate their effectiveness in classification. Further, these methods are designed to be portable and adaptable to different operating systems, and they can also be scaled for multi-class malware detection.

Place, publisher, year, edition, pages
Karlskrona: Blekinge Tekniska Högskola, 2024
Series
Blekinge Institute of Technology Doctoral Dissertation Series, ISSN 1653-2090 ; 3
Keywords
Malware Detection, Android Malware, Machine Learning, Static Malware Analysis, Cyber Security, Ensemble learning, Supervised Learning, Feature Selection
National Category
Computer Sciences
Research subject
Computer Science
Identifiers
urn:nbn:se:bth-25793 (URN)978-91-7295-475-5 (ISBN)
Public defence
2024-01-31, J1630, Campus Karlskrona, 13:00 (English)
Opponent
Supervisors
Available from: 2024-01-09 Created: 2024-01-09 Last updated: 2024-01-11Bibliographically approved

Open Access in DiVA

fulltext(234 kB)485 downloads
File information
File name FULLTEXT01.pdfFile size 234 kBChecksum SHA-512
0005a687508bef5ee1dd2c93aae7bc798b50c777b3e481eb9a8592dc7f2b1fac65eb982220a966962c9467c637355094366b2047306e31e80ad0f37975109ece
Type fulltextMimetype application/pdf

Authority records

Lavesson, Niklas

Search in DiVA

By author/editor
Lavesson, Niklas
Computer Sciences

Search outside of DiVA

GoogleGoogle Scholar
Total: 485 downloads
The number of downloads is the sum of all downloads of full texts. It may include eg previous versions that are now no longer available

isbn
urn-nbn

Altmetric score

isbn
urn-nbn
Total: 203 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf