Effective and Efficient Malware Detection at the End Host

By Clemens Kolbitsch, Paolo Milani Comparetti, Christopher Krügel, Engin Kirda, Xiao-yong Zhou, Xiaofeng Wang. USENIX Security Symposium, 2009

580 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/4491e3a4869ca6dbf404ddbf1dbb6c4d2583b5c8

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

IReEn: Iterative Reverse-Engineering of Black-Box Functions via Neural Program Synthesis (2020, background): “This is a desired scenario in software engineering (Lee et al., 2011; Fu et al., 2019), or security, which reverse-engineers, e.g., binary executables for analysis and for ﬁnding potential vulnerabilities (Kolbitsch et al., 2009; Yakdan et al., 2016).”
A Survey on Malware Detection Using Data Mining Techniques (2017, methodology): “Consequently, many studies have been reported on using data mining and machine learning techniques to develop intelligent malware detection systems [Schultz et al. 2001; Kolter and Maloof 2004; Karim et al. 2005; Lee and Mody 2006; Ye et al. 2007; Moskovitch et al. 2008a; Kolbitsch et al. 2009; Ye e”
DroidChameleon: evaluating Android anti-malware against transformation attacks (2013, unknown): “[17] also propose similar techniques.”
Semantics-Aware Android Malware Classification Using Weighted Contextual API Dependency Graphs (2014, unknown): “D.2.4 [Software Engineering]: Software/Program Verification— Validation; D.4.6 [Operating Systems]: Security and Protection— Invasive software”
MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models (2016, background): “Signaturebased methods, however, can be evaded using polymorphism and obfuscation, as well as by call re-ordering attacks [36], even though quantitative measures, such as similarity analysis, can be used to address some of these attacks [48].”
Structural detection of android malware using embedded call graphs (2013, background): “Researchers dealing with the detection of malware targeting desktop systems have discovered that high-level properties of code, in particular function call graphs, offer a suitably robust representation to account for these variations [21, 25].”
Vetting undesirable behaviors in android apps with permission use analysis (2013, methodology): “Thus, we believe VetDroid could be integrated with existing behavior-based malware detection techniques [14, 39] to extract effective malware signatures for clustering and detection.”
A comparison of static, dynamic, and hybrid analysis for malware detection (2015, methodology): “In [27], the authors build fine-grained models that are designed to capture the behavior of malware based on system calls.”
Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues (2013, background): “For instance, malware behavior can be characterized through network traffic analysis [83], [122], [118].”
SourceFinder: Finding Malware Source-Code from Publicly Available Repositories (2020, background): “9 Related Work There are several works that attempt to determine if a piece of software is malware, usually focusing on a binary, using static or dynamic analysis [4, 17, 35, 57].”
Detection of Intrusions and Malware, and Vulnerability Assessment (2013, methodology): “In: Proceedings of the ACM Workshop on Artificial Intelligence and Security (AISec) (October 2012) [11] Leder, F.”
Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification (2015, unknown): “In order to devise an eﬀective and more robust system, some approaches considered additional semantic information like the sequence of the API calls [9], and the use of graph representations [27, 20, 26].”
Automatic analysis of malware behavior using machine learning (2011, unknown): “For example, samples of discovered malware classes can be directly used for observing current trends in malware development [5], constructing efﬁcient detection patterns [28] and designing automata of malicious behavior [27].”
A Comprehensive Review on Malware Detection Approaches (2020, methodology): “[79] proposed a graph-based detection, in which the system calls are converted into a behavior graph, where nodes represented system calls and edges indicated transitions among system calls that showed the data dependency.”
POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting (2019, methodology): “[36] automatically generate behavior models of malware using symbolic execution.”
Scalable fine-grained behavioral clustering of HTTP-based malware (2013, methodology): “Also, in [22] the authors do not apply any behavioral clustering, and the system-level signatures they extract are often too specific, as demonstrated by their relatively low detection rate for certain malware families.”