Mining Distinguishing Patterns Based on Malware Traces

摘要：

The automatic generation of malicious behavior pattern based on system caD trace is important to malware detection. This paper studied the existing generation method of malicious behavior specification. In order to reduce the complexity of pattern generation, it constructs graph which vertex label is unique, and uses these graphs to mine the pattern. To address the issue of limitation of the minimal contrast subgraph mining method, it uses multiple positive and negative samples, and proposes a mining method to mine distinguishing patterns based on mutual information. It designs the overall framework of mining process, and gives the mining algorithm. Finally, validation results demonstrate the effectiveness.

关键词： Malicious behavior System Call Trace Subgraph Mining Distinguishing Pattern Mutual Information

作者: Xiaoyan Sun Qian Huang Yuefei Zhu Ning Guo

作者单位: Zhengzhou Information Science and Technology Institute Zhengzhou, Henan, China Lanzhou University Lanzhou, Gansu, China

会议类型: 国际会议

会议名称: 2010 3rd IEEE International Conference on Computer Science and Information Technology(第三届IEEE计算机科学与信息技术国际会议 ICCSIT 2010)

会议地点: 成都

会议语种:英文

页码: 677-681

在线出版日期: 2010-07-07（万方平台首次上网日期，不代表论文的发表时间）