AccessMiner
Published 4 October 2010
Andrea Lanzi, Davide Balzarotti, Christopher Kruegel, Mihai Christodorescu, Engin Kirda
Citations176
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
The system-centric approach models the way in which benign programs access OS resources (such as files and registry entries) and raises very few (even zero) false positives while being able to detect a significant fraction of today's malware.
Abstract
Models based on system calls are a popular and common approach to characterize the run-time behavior of programs. For example, system calls are used by intrusion detection systems to detect software exploits. As another example, policies based on system calls are used to sandbox applications or to enforce access control. Given that malware represents a significant security threat for today's computing infrastructure, it is not surprising that system calls were also proposed to distinguish between benign processes and malicious code.
Keywords
Computer Science
Data mining methods for detection of new malicious executables
1,059 Citations2002Matthew G. Schultz, Eleazar Eskin +2 more
This work presents a data mining framework that detects new, previously unseen malicious executables accurately and automatically and more than doubles the current detection rates for new malicious executable.
Choice Reviews OnlineThe art of computer virus research and defense
841 Citations2005
Unlike most books on computer viruses, The Art of Computer Virus Research and Defense is a reference written strictly for white hats: IT and security professionals responsible for protecting their organizations against malware.
Semantics-aware malware detection
719 Citations2005Mihai Christodorescu, Somesh Jha +3 more
Experimental evaluation demonstrates that the malware-detection algorithm can detect variants of malware with a relatively low run-time overhead and the semantics-aware malware detection algorithm is resilient to common obfuscations used by hackers.
Mimicry attacks on host-based intrusion detection systems
707 Citations2002David Wagner, Paolo Soto
This work introduces the notion of a mimicry attack, which allows a sophisticated attacker to cloak their intrusion to avoid detection by the IDS, and develops a theoretical framework for evaluating the security of an IDS against mimicry attacks.
Panorama
684 Citations2007Heng Yin, Dawn Song +3 more
This work proposes a system, Panorama, to detect and analyze malware by capturing malicious information access and processing behavior, which separates these malicious applications from benign software.
Lecture notes in computer scienceLearning and Classification of Malware Behavior
577 Citations2008Konrad Rieck, Thorsten Holz +3 more
The effectiveness of the proposed method for learning and discrimination of malware behavior is demonstrated, especially in detecting novel instances of malware families previously not recognized by commercial anti-virus software.
Scalable, behavior-based malware clustering
568 Citations2009Ulrich Bayer
Recent researchers have started to explore automated clustering techniques that help to identify samples that exhibit similar behavior, which allows an analyst to discard reports of samples that have been seen before, while focusing on novel, interesting threats.
Integrating Flexible Support for Security Policies into the Linux Operating System
526 Citations2001Peter Loscocco, Stephen Smalley
Lecture notes in computer scienceAutomated Classification and Analysis of Internet Malware
505 Citations2007Michael Bailey, Jon Oberheide +4 more
This paper examines the ability of existing host-based anti-virus products to provide semantically meaningful information about the malicious software and tools used by attackers and proposes a new classification technique that describes malware behavior in terms of system state changes rather than in sequences or patterns of system calls.
Effective and efficient malware detection at the end host
390 Citations2009Clemens Kolbitsch, Paolo Milani Comparetti +4 more
A novel malware detection approach is proposed that is both effective and efficient, and thus, can be used to replace or complement traditional antivirus software at the end host.
Lecture notes in computer sciencePolymorphic Worm Detection Using Structural Information of Executables
324 Citations2006Christopher Kruegel, Engin Kirda +3 more
A novel technique based on the structural analysis of binary code that allows one to identify structural similarities between different worm mutations is presented, which has been used as a basis for a worm detection system that is resilient to many of the mechanisms used to evade approaches based on instruction sequences only.
Rootkits: Subverting the Windows Kernel
305 Citations2005Greg Hoglund, Jamie M. Butler
Rootkits, two of the world's leading experts have written the first comprehensive guide to rootkits: what they are, how they work, how to build them, and how to detect them.
Mining specifications of malicious behavior
277 Citations2007Mihai Christodorescu, Somesh Jha +1 more
The technique derives a specification of malicious behavior by comparing the execution behavior of a known malware against the execution behaviors of a set of benign programs, and indicates that the algorithm is effective in extracting malicious behaviors that can be used to detect malware variants.
Lecture notes in computer scienceDetecting Self-mutating Malware Using Control-Flow Graph Matching
234 Citations2006Danilo Bruschi, Lorenzo Martignoni +1 more
This paper proposes a strategy for the detection of metamorphic malicious code inside a program P based on the comparison of the control flow graph of P against the set of control flow graphs of known malware.
Behavior-based spyware detection
231 Citations2006Engin Kirda, Christopher Kruegel +3 more
A novel technique for spyware detection that is based on the characterization of spywarelike behavior is presented, which shows that it is possible to reliably identify malicious components using an abstract behavioral characterization.
Fileprints: identifying file types by n-gram analysis
227 Citations2005Wei‐Jen Li, Ke Wang +2 more
The aim is to be able to accurately identify the true type of an arbitrary file using statistical analysis of their binary contents without parsing, and to determine the type of a file if its name does not announce its true type.
Lecture notes in computer scienceLearning More about the Underground Economy: A Case-Study of Keyloggers and Dropzones
220 Citations2009Thorsten Holz, Markus Engelberth +1 more
This work investigates keylogger-based stealing of credentials via dropzones, anonymous collection points of illicitly collected data, and presents an empirical study of this phenomenon, giving many first-hand details about the attacks that were observed during a seven-month period between April and October 2008.
Static Analyzer of Vicious Executables (SAVE)
212 Citations2005Andrew H. Sung, Jianyun Xu +2 more
This paper presents a robust signature-based malware detection technique, with emphasis on detecting obfuscated malware and mutated (or metamorphic) malware.
Studying spamming botnets using Botlab
183 Citations2009John P. John, Alexander Moshchuk +2 more
It is found that six botnets are responsible for 79% of spam messages arriving at the UW campus, and defensive tools that take advantage of the Botlab platform to improve spam filtering and protect users from harmful web sites advertised within botnet-generated spam are presented.
Automating mimicry attacks using static binary analysis
178 Citations2005Christopher Kruegel, Engin Kirda +3 more
A novel technique to evade the extended detection features of state-of-the-art intrusion detection systems and reduce the task of the intruder to a traditional mimicry attack is presented.
Mining specifications of malicious behavior
141 Citations2008Mihai Christodorescu, Somesh Jha +1 more
The technique derives such a specification by comparing the execution behavior of a known malware against the execution behaviors of a set of benign programs so that the output of the algorithm can be used by malware detectors to detect malware variants.
Learning classifiers for misuse and anomaly detection using a bag of system calls representation
140 Citations2005Dae-Ki Kang, Doug Fuller +1 more
The results show that standard machine learning and clustering techniques on simple "bag of system calls" representation of system call sequences is effective and often performs better than those approaches that use foreign contiguous subsequences in detecting intrusive behaviors of compromised processes.
Lecture notes in computer scienceA Layered Architecture for Detecting Malicious Behaviors
130 Citations2008Lorenzo Martignoni, Elizabeth Stinson +3 more
This work effectively distinguished malicious execution of high-level behaviors from benign by identifying remotely-initiated actions and designed to preemptively address evasive malware behavior.
Lecture notes in computer scienceCharacterizing Bots’ Remote Control Behavior
126 Citations2007Elizabeth Stinson, John C. Mitchell
This work monitors execution of an arbitrary Win32 binary, considering data received over the network to be tainted, applying library-call-level taint propagation, and checking for tainted arguments to selected system calls.
Polymorphic Malicious Executable Scanner by API Sequence Analysis
75 Citations2005Jianyun Xu, Andrew H. Sung +2 more
This paper proposes a new approach for detecting polymorphic malware in the Windows platform based on an analysis based on the Windows API calling sequence that reflects the behavior of a piece of particular code.
PinUP: Pinning User Files to Known Applications
14 Citations2008William Enck, Patrick McDaniel +1 more
This paper describes the implementation of PinUP on the Linux Security Modules framework, explores its performance, and studies several practical use cases to show that user data can be protected from untrusted applications while retaining the ability to receive the benefits of those applications.
Dynamic Monitoring of Malicious Activity in Software Systems
10 Citations2000Mourad Debbabi, M. A. Girard +3 more
This paper presents a research effort to help manage the risk associated with COTS integration through the exploitation of a dynamic monitor to meet a formal security specification.
Munich Personal RePEc Archive (Ludwig Maximilian University of Munich)Dynamic Detection of Malicious Code in COTS Software
4 Citations2000Martin Salois, Robert Charpentier
A dynamic approach that intends to address the complexity of a real time-bomb and hopefully of all types of malicious actions is presented, the first step toward a fully automated tool to detect malicious actions in all their forms.