Sirageldin, A. and Baharudin, B. and Jung, L.T. (2012) Detecting malicious executable file via graph comparison using support vector machine. In: UNSPECIFIED.
Full text not available from this repository.Abstract
In every day, Anti-virus Corporations receive large number of potentially harmful executables. Many of the malicious samples among these executables are variations of their early versions that created by their authors to evade the detection. Consequently, robust detection approaches are required, capable of recognizing similar samples automatically. In this paper, malware detection through call graph was studied, the call graph functions of a binary executable are represented as vertices, and the calls between those functions as edges. By representing malware samples as call graphs, it is possible to derive and detect structural similarities between multiple samples. The present paper provides a new malware detection algorithm based on the analysis of graphs introduced from instructions of the executable objects, the graph is constructed through the graph extractor, and the maximum common sub-graph similarity measures is approximated, then the graphs are sent to support vector machine to perfectly approximate the similarity value. © 2012 IEEE.
Item Type: | Conference or Workshop Item (UNSPECIFIED) |
---|---|
Additional Information: | cited By 3; Conference of 2012 International Conference on Computer and Information Science, ICCIS 2012 - A Conference of World Engineering, Science and Technology Congress, ESTCON 2012 ; Conference Date: 12 June 2012 Through 14 June 2012; Conference Code:93334 |
Uncontrolled Keywords: | benign; Common subgraph; Function calls; graph; Malwares; Similarity measure, Information science; Support vector machines; Technology; Viruses; XML, Computer viruses |
Depositing User: | Mr Ahmad Suhairi UTP |
Date Deposited: | 09 Nov 2023 15:51 |
Last Modified: | 09 Nov 2023 15:51 |
URI: | https://khub.utp.edu.my/scholars/id/eprint/2817 |