A framework for malware identification based on behavior
Malware is one of the major security threats in a computer and network environment. Modem malware embeds several techniques in order to complicate malware defence. The current malware issues such as zero-day attacks, malware avoidance techniques and hybrid malware are highlighted. Furthermore, a com...
Saved in:
| Main Author: | |
|---|---|
| Format: | Thesis |
| Language: | English |
| Published: |
2012
|
| Subjects: | |
| Online Access: | http://umpir.ump.edu.my/id/eprint/13456/1/MOHAMAD%20FADLI%20ZOLKIPLI.pdf |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| id |
my-ump-ir.13456 |
|---|---|
| record_format |
uketd_dc |
| spelling |
my-ump-ir.134562021-08-19T05:16:10Z A framework for malware identification based on behavior 2012 Mohamad Fadli, Zolkipli QA76 Computer software T Technology (General) Malware is one of the major security threats in a computer and network environment. Modem malware embeds several techniques in order to complicate malware defence. The current malware issues such as zero-day attacks, malware avoidance techniques and hybrid malware are highlighted. Furthermore, a common approach in malware defence does not provide enough solution to prevent modern malware attacks. Considering the above issues, a new framework for malware identification based on behavior is proposed. This framework consists of three major components; i) behavior analysis, ii) malware prediction and iii) malware target classification. The behavior analysis applies a dynamic approach with a combination of Run Time Analysis and Resource Monitoring. For malware prediction, there are four areas of malware features which are i) process, ii) file, iii) registry, and iv) network activities. The IF-THEN Prediction Rules which is generated using the data mining technique, ID3 Algorithm is used. In the implementation of malware target classification, Structure Level Rules are utilized to classify malware into possible target class. These three major components are integrated together as a cohesive unit for malware identification through knowledge storage. The experiment on the framework shows that as compared to several other related works, this framework provides better solutions on malware behavior definition, prediction and target classification. From the results, it is proven that the framework can be implemented as one of the security practices to counter the modern malware attacks in a computer environment. 2012 Thesis http://umpir.ump.edu.my/id/eprint/13456/ http://umpir.ump.edu.my/id/eprint/13456/1/MOHAMAD%20FADLI%20ZOLKIPLI.pdf application/pdf en public phd doctoral Universiti Sains Malaysia Faculty of Computer System and Software Engineering |
| institution |
Universiti Malaysia Pahang Al-Sultan Abdullah |
| collection |
UMPSA Institutional Repository |
| language |
English |
| topic |
QA76 Computer software T Technology (General) |
| spellingShingle |
QA76 Computer software T Technology (General) Mohamad Fadli, Zolkipli A framework for malware identification based on behavior |
| description |
Malware is one of the major security threats in a computer and network environment. Modem malware embeds several techniques in order to complicate malware defence. The current malware issues such as zero-day attacks, malware avoidance techniques and hybrid malware are highlighted. Furthermore, a common approach in malware defence does not provide enough solution to prevent modern malware attacks. Considering the above issues, a new framework for malware identification based on behavior is proposed. This framework consists of three major components; i) behavior analysis, ii) malware prediction and iii) malware target classification. The behavior analysis applies a dynamic approach with a combination of Run Time Analysis and Resource Monitoring. For malware prediction, there are four areas of malware features which are i) process, ii) file, iii) registry, and iv) network activities. The IF-THEN Prediction Rules which is generated using the data mining technique, ID3 Algorithm is used. In the implementation of malware target classification, Structure Level Rules are utilized to classify malware into possible target class. These three major components are integrated together as a cohesive unit for malware identification through knowledge storage. The experiment on the framework shows that as compared to several other related works, this framework provides better solutions on malware behavior definition, prediction and target classification. From the results, it is proven that the framework can be implemented as one of the security practices to counter the modern malware attacks in a computer environment. |
| format |
Thesis |
| qualification_name |
Doctor of Philosophy (PhD.) |
| qualification_level |
Doctorate |
| author |
Mohamad Fadli, Zolkipli |
| author_facet |
Mohamad Fadli, Zolkipli |
| author_sort |
Mohamad Fadli, Zolkipli |
| title |
A framework for malware identification based on behavior |
| title_short |
A framework for malware identification based on behavior |
| title_full |
A framework for malware identification based on behavior |
| title_fullStr |
A framework for malware identification based on behavior |
| title_full_unstemmed |
A framework for malware identification based on behavior |
| title_sort |
framework for malware identification based on behavior |
| granting_institution |
Universiti Sains Malaysia |
| granting_department |
Faculty of Computer System and Software Engineering |
| publishDate |
2012 |
| url |
http://umpir.ump.edu.my/id/eprint/13456/1/MOHAMAD%20FADLI%20ZOLKIPLI.pdf |
| _version_ |
1783731984024993792 |