Learning and Classification of Malware Behavior

By Konrad Rieck, Thorsten Holz, Carsten Willems, Patrick Düssel, Pavel Laskov. 2008

670 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Security analysis of online centroid anomaly detection (2010, positive): “Machine learning methods can also help researchers to better understand the design of malicious software by using classification or clustering techniques together with special malware acquisition and monitoring tools (Bailey et al., 2007; Rieck et al., 2008).”
Looking at the bag is not enough to find the bomb: an evasion of structural methods for malicious PDF files detection (2013, methodology): “CWSandbox has also been used to classify general malware behavior [30].”
DUET: integration of dynamic and static analyses for malware clustering with cluster ensembles (2013, methodology): “For instance, DUET-D is built upon the state-of-the-art malware analysis tool Malheur[27].”
Detection of Malicious PDF Files Based on Hierarchical Document Structure (2013, background): “, [30, 31] for exemplary interpretations of linear SVM in security applications), is attackable with a moderate effort.”
Effective and Efficient Malware Detection at the End Host (2009, methodology): “Such reports can be evaluated to find clusters of samples that behave similarly [5, 7] or to classify the type of observed, malicious activity [39].”
Automated Dynamic Analysis of Ransomware: Benefits, Limitations and use for Detection (2016, methodology): “In [27] the authors propose a new method to learn and discriminate malware behaviour.”
Neural Nets Can Learn Function Type Signatures From Binaries (2017, background): “Many other works use traditional machine learning techniques such as n-grams analysis [42], SVMs [36], and conditional random fields [37] for binary analysis tasks (different from ours).”
PUMA: Permission Usage to Detect Malware in Android (2012, background): “Besides, several approaches [6, 7] have been proposed to classify applications specifying the malware class; e.”
Scalable, Behavior-Based Malware Clustering (2009, background): “[28] presented a system that classifies unknown malware samples based on their behavior.”
Scalable fine-grained behavioral clustering of HTTP-based malware (2013, background): “) [7, 32, 8, 20], and only limited information from the network traces is used.”
Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables (2018, background): “Although past research work on binary malware detection has explored the use of traditional learning algorithms on n-gram-based, system-call-based, or behavior-based features [1], [19], [21], [26], more recent work”
Vetting undesirable behaviors in android apps with permission use analysis (2013, background): “, [14,16, 21, 22, 33, 40, 49]) that focuses on solutions to construct effective behavior representations.”
Evaluation and Design of Robust Neural Network Defenses (2018, methodology): “In the space of malware, machine learning has been used to detect malware from benign files [21, 104, 20, 29, 60, 108] (even using neural networks [24]) and an equal amount of work has been performed on attacking such classifiers [75, 134, 89, 92].”
Malware Classification with Deep Convolutional Neural Networks (2018, methodology): “The major drawback of classical signature-based detection is that it is not scalable and its effectiveness can be undermined with the growing variants of malware [13].”
A Probabilistic Discriminative Model for Android Malware Detection with Decompiled Source Code (2015, methodology): “Other work has used the same general idea of behavioral analysis, but extended the technique of matching malicious code using several machine learning techniques such as support vector machines [18] and clustering [19].”
Analysis of Machine learning Techniques Used in Behavior-Based Malware Detection (2010, background): “[3] aim to exploit specific shared patterns for classification of malware.”
Optimized Cutting Plane Algorithm for Large-Scale Risk Minimization (2009, methodology): “While the classification accuracy was the main focus in Rieck et al. (2008), the issue of fast training was not addressed.”