A Self-Relocation Based Method for Malware Detection

Abstract:

Malware (malicious software) is software designed to disrupt computer operation, gather sensitive information, or gain unauthorized access to a computer system. Most malwares propagate themselves throughout the Internet by self-relocation. Self-relocation is a built-in module in most malwares that gets the base address of the code to correctly infect the other programs. Since most legitimate computer programs do not need the self-relocate module, the detection of malware with self-relocation module can be viewed as a promising approach for malware detection. This paper presents a self-relocation based method for both known and previously unknown malwares. The experiments indicate that the proposed approach has better ability to detect known and unknown malwares than other methods.

• Periodical: Applied Mechanics and Materials (Volumes 220-223)
• Pages: 2688-2693
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.220-223.2688
• Online since: November 2012
• Authors: Yu Zhang, Feng Xia
• Keywords: Malicious Software, Malware Detection, Self-Relocation

References

[1] Richard Ford, Eugene H. Spafford, Happy birthday, dear viruses. Science, 2007, vol. 317: 210-211.

DOI: 10.1126/science.1140909

[2] Stephen Trilling, Carey Nachenberg. The future of malware. EICAR Proceedings 1999.

[3] Sandeep Kumar, Eugene H. Spafford. A generic virus scanner in C++. Proceedings of the 8th Computer Security Applications Conference, 1992, 210-219.

[4] Nwokedi Idika, Aditya P. Mathur. A Survey of Malware Detection Techniques. http://www.serc.net/report/tr286.pdf, February, 2007.

[5] Victor Skormin, Alexander Volynkin, Douglas Summerville, et al. In the search of the "gene of self-replication" in malicious codes. Proceedings of IEEE Workshop on Information Assurance and Security, 2005, 193-200.

DOI: 10.1109/iaw.2005.1495952

[6] V. Skormin, D. Summerville, J. Moronski. Detecting Malicious Codes by the presence of their Gene of Self-Replication, Computer Network Security, Lecture Notes in Computer Science, 2003, vol. 2776.

DOI: 10.1007/978-3-540-45215-7_16

[7] Douglas Summerville, Victor Skormin, Alexander Volynkin, et al. Prevention of Information Attacks by Run-Time Detection of Self-replication in Computer Codes. Lecture Notes in Computer Science, 2005, vol. 3685: 54 – 75.

DOI: 10.1007/11560326_5

[8] D. Ellis, J. Aiken, K. Attwood, and S. Tenaglia. A behavioral approach to worm detection. Proceedings of the 2004 ACM Workshop on Rapid Malcode, 2004, 43–53.

DOI: 10.1145/1029618.1029625

[9] R. Moskovitch, N. Nissim, Y. Elovici. Malicious Code Detection and Acquisition Using Active Learning. IEEE Intelligence and Security Informatics, 2007, 371 – 371.

DOI: 10.1109/isi.2007.379505

[10] Yuval Elovici, Asaf Shabtai, Robert Moskovitch, et al. Applying Machine Learning Techniques for Detection of Malicious Code in Network Traffic. Proceedings of the 30th Annual German Conference on Artificial Intelligence, 2007, 44-50.

DOI: 10.1007/978-3-540-74565-5_5

[11] J.Z. Kolter, M.A Maloof. Learning to detect malicious executables in the wild. Proceedings of the Tenth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2004, 470–478.

DOI: 10.1145/1014052.1014105

[12] Guojpeng/CVC.GB. The analysis of Win32 PE viruses. 2003, http://www.hynubbs.cn/netstar/news_view.asp?id=61.

[13] Sipser Michael. Introduction to the Theory of Computation, Second Edition, Boston Mass: Thomson Course Technology, 2006.

[14] VX Heavens. http://vx.netlux.org

[15] Kaspersky Lab. http://www.kaspersky.com

[16] J. Y. Xu, A. H. Sung, P. Chavez. Polymorphic malicious executable scanner by API sequence analysis. Fourth International Conference on Hybrid Intelligent Systems, 2004, 378 - 383.

DOI: 10.1109/ichis.2004.75