Abstract:The traditional malware detection schemes based on specific signature give an unsatisfactory performance as disposing the previously unknown malware, so the general features of binary files should be explored to solve this problem. Recently, classification algorithms were employed successfully to choose the features in unknown malicious code, and most of the works use byte or operation code sequence n‐gram representation of the executables. However, these n‐gram representations are heavily dependent on the training data. In this paper, we present a graph‐based method to detect unknown malware. The function call graph of an executable, which includes the functions and the call relations between them, is selected as the representation of the executable in this method. The features are defined according to both the statistical information and the topology of the function call graph. They are extracted and processed through machine learning to classify unknown Portable Executable files. For the sake of fixed sum of the features, the graph‐based method can avoid so many features found in other methods. In our experiments, three types of malware datasets were tested, and as high as 96.8% accuracy can be achieved. Furthermore, it can achieve 92.1% accuracy when only 5% of the dataset is served as training set. Copyright © 2012 John Wiley & Sons, Ltd. To detect the unknown malware, the features of graph‐based method are predefined from function call graph of software, and then the rules are built with these features to classify an executable as the benign or the malware. The quantity and the contents of these features are independent of testing dataset, and this peculiarity enables our experiment results to nearly reflect the situation of unknown malware detection. The design can provide a high malware detection accuracy by using a small set of training set.

Novel Intrusion Detection Algorithm Based on Graph

Host Intrusion Detection Based on Sequence of Windows Native API

An Intrusion Detection System Based on FRete Net Algorithm

Intrusion Detection And Simulation For High-Speed Networks

Ignnvd: A Novel Software Vulnerability Detection Model Based on Integrated Graph Neural Networks

Anomaly Detection Model Based on Windows Native API Sequences

Host computer intrude detecting method decomposed based on inherent subsequence mode

Novel Network Intrusion Detection Algorithm Based on Sequence Data Mining

Network intrude detecting method based on inherent subsequence mode decomposition

Intrusion detection based on graph-directed analytics of the big data

An unknown malware detection scheme based on the features of graph

Decision Tree Algorithm-based Host Anomaly Detection Using Windows Native API Sequences

Malware Detection Based on Critical Application Programming Interface Graph

An Intrinsic Subsequence Decomposition Algorithm for Network Intrusion Detection.

Research on Principle Techniques for Network Intrusion Detection Based on Data Mining and Analysis Approach

Discovering Novel Multistage Attack Strategies

Sequence Feature Extraction-Based APT Attack Detection Method with Provenance Graphs

A novel intrusion detection method for mobile ad hoc networks

Implementation Of Sequence Patterns Mining In Network Intrusion Detection System

New algorithm mining intrusion patterns

Intrusion Detection Based on System Calls and Call Stack Log