Data mining methods for detection of new malicious executables

By Matthew G. Schultz, Eleazar Eskin, Erez Zadok, Salvatore J. Stolfo. Proceedings 2001 IEEE Symposium on Security and Privacy. S&P 2001, 2001

1,157 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/31cfc6e2281426f4dd7325d73e105dc10bf5cdd5

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables (2018, background): “Although past research work on binary malware detection has explored the use of traditional learning algorithms on n-gram-based, system-call-based, or behavior-based features [1], [19], [21], [26], more recent work”
Machine Learning for Android Malware Detection Using Permission and API Calls (2013, background): “Each Android application is compiled and packaged in a single file that includes all of the application code (.dex files), resources, assets, and manifest file.”
Malware Analysis and Classification: A Survey (2014, background): “[25] were the first to introduce the concept of data mining for detecting malwares.”
Malware Classification with Deep Convolutional Neural Networks (2018, methodology): “They typically use an SVM-based classifier [4], [13], Naı̈ve Bayes classifier [15], or multiple classifiers (naive Bayes, decision trees, SVM) [16].”
Opcode sequences as representation of executables for data-mining-based unknown malware detection (2013, background): “To this end, Schultz et al. [69] were the ﬁrst to introduce the idea of applying data-mining models to the detection of diﬀerent malicious programs based on their respective binary codes.”
Polonium: Tera-Scale Graph Mining and Inference for Malware Detection (2011, background): “For example, some “less harmful” spyware programs collect the user’s browsing history, while the “more harmful” ones steal sensitive information such as credit card numbers and passwords; depending on what it collects, a spyware can be considered malicious, or only undesirable.”
Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning (2018, methodology): “Machine learning-based static PE malware detectors have been used since at least 2001 [27], and owing largely to the structured file format and backwards-compatibility requirements, many concepts remain surprisingly similar in subsequent works [8, 16, 24, 26, 28].”
Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN (2017, methodology): “For example, Schultz et al. proposed to use DLLs, APIs and strings as features for classiﬁcation [Schultz et al. , 2001], while Kolter et al. used byte level N-Gram as features [Kolter and Maloof, 2004; Kolter and Maloof, 2006].”
Survey on the Usage of Machine Learning Techniques for Malware Analysis (2017, background): “A few works use chunks of bytes of specic sizes [68, 72], while many others rely on n-grams [1, 3, 4, 15, 19, 27, 37, 42, 50, 61, 69, 72, 75, 76, 80].”
Learning to Detect and Classify Malicious Executables in the Wild (2006, background): “There have been few attempts to use machine learning and data mining for the purpose of identifying new or unknown malicious code (e.g., Lo et al., 1995; Kephart et al., 1995; Tesauro et al., 1996; Schultz et al., 2001; Kolter and Maloof, 2004).”
Deep neural network based malware detection using two dimensional binary program features (2015, methodology): “Numerous static features have been proposed for extracting features from binaries: printable strings [31], import tables [33], byte n-grams [4], opcodes [33], informational entropy [33].”
A Survey on Malware Detection Using Data Mining Techniques (2017, methodology): “They applied different kinds of classiﬁers on the extracted feature set, including ID3 and J48 DTs, NB, and SVM, and obtained better results than those with traditional feature selection methods as shown in Schultz et al. [2001].”
Summoning Demons: The Pursuit of Exploitable Bugs in Machine Learning (2017, background): “These assumptions are realistic in many settings; for example, the machine learning techniques proposed for malware classiﬁcation or clustering [33, 28, 10, 31] operate on inputs that come from many sources, including possible adversaries.”
Learning to detect malicious executables in the wild (2004, methodology): “[37] used non-overlapping two-byte sequences, whereas we used overlapping sequences of four bytes.”
Malware Detection by Eating a Whole EXE (2017, methodology): “The Group A data was collected in the same manner as most work in the malware identiﬁcation literature (Schultz et al. 2001; Kolter and Maloof 2006) , which is available to the public.”