Software family detection based on behavior analysis

Cen Chen; Wen Yang; ZhiMin Guo; Junfei Cai; Xin Che

doi:10.1117/12.2636594

6 May 2022 Software family detection based on behavior analysis

Cen Chen, Wen Yang, ZhiMin Guo, Junfei Cai, Xin Che

Proceedings Volume 12176, International Conference on Algorithms, Microchips and Network Applications; 121761A (2022) https://doi.org/10.1117/12.2636594
Event: International Conference on Algorithms, Microchips, and Network Applications 2022, 2022, Zhuhai, China

Abstract

With the development of network technology, information security faces many threats. Malware shows an explosive growth trend, malware variants also emerge in endlessly, and malware detection is currently one of the necessary means to ensure information security. This paper conducts a detailed investigation on the malware detection mechanism based on behavior analysis, and introduces three types of malicious software detection technology, including methods based on statistics, methods based on system call graph, and methods based on structures. Generally, the goal of network intrusion and system intrusion is to steal sensitive information, such as file modification, or even controlling the host to perform remote attacks. Most of these operations require functions provided by the kernel layer, so it is inevitable to use multiple system calls. In addition, malicious behavior can be detected to a large extent by monitoring the execution of system calls. This paper introduces the detection technology based on system call graph, including function call graph method, control flow graph method, and data flow graph method. The paper also discusses the features of advanced detection technology based on system call graph. Moreover, the paper analyzes the data set, modeling language and evaluation performance index used for system call graph based detection technology, which will help security researchers evaluate the applicability and limitations of detection algorithms to identify malicious behaviors, so as to design more efficient detection strategies. Finally, this paper clarifies the role of features in malicious behavior identification and the characteristics of various detection methods, which can help security researchers to break through the limitations of traditional detection technology.

Citation Download Citation

Cen Chen, Wen Yang, ZhiMin Guo, Junfei Cai, and Xin Che "Software family detection based on behavior analysis", Proc. SPIE 12176, International Conference on Algorithms, Microchips and Network Applications, 121761A (6 May 2022); https://doi.org/10.1117/12.2636594

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available

Members: $17.00

Non-members: $21.00 ADD TO CART

PROCEEDINGS
7 PAGES

DOWNLOAD PAPER SAVE TO MY LIBRARY

GET CITATION

RIGHTS & PERMISSIONS

Get copyright permission Get copyright permission on Copyright Marketplace

KEYWORDS

Data modeling

Feature extraction

Statistical analysis

Analytical research

Computer security

Control systems

Databases

Show All Keywords

Keywords/Phrases

Search In:

Publication Years