A Novel Anomaly Detection Approach for Executable Program Security

摘要：

Anomaly detection of executable program is a security detection solution that examines whether security violation issues exist in programs. The paper presents a novel anomaly detection approach for executable program security (ADEPS), which monitors program executions and detects anomalous program behaviors. Through reverse analysis of executable program, critical behavior monitoring points can be extracted from binary code sequences and memory space. A hybrid neural network model is proposed to detect abnormal attacks and classify detected attacks from actual program behaviors. The experimental results demonstrate that the proposed approach can effectively and accurately perform anomaly detection.

关键词： anomaly detection executable program reverse analysis neural network

作者: Wei Pan Weihua Li Wanxin Zhao

作者单位: School of Computer Science Northwestern Polytechnical University Shaanxi, Xian, 710129, China School of Automation Northwestern Polytechnical University Shaanxi, Xian, 710129, China

会议类型: 国际会议

会议名称: The First International Conference on Multimedia Information Networking and Security(第一届国际多媒体网络信息安全会议 MINES 2009)

会议地点: 武汉

会议语种:英文

页码: 422-426

在线出版日期: 2009-11-18（万方平台首次上网日期，不代表论文的发表时间）