Mohamad Fadli, Zolkipli (2012) A framework for malware identification based on behavior. PhD thesis, Universiti Sains Malaysia (Contributors, UNSPECIFIED: UNSPECIFIED).
|
PDF
MOHAMAD FADLI ZOLKIPLI.pdf - Published Version Download (9MB) | Preview |
Abstract
Malware is one of the major security threats in a computer and network environment. Modem malware embeds several techniques in order to complicate malware defence. The current malware issues such as zero-day attacks, malware avoidance techniques and hybrid malware are highlighted. Furthermore, a common approach in malware defence does not provide enough solution to prevent modern malware attacks. Considering the above issues, a new framework for malware identification based on behavior is proposed. This framework consists of three major components; i) behavior analysis, ii) malware prediction and iii) malware target classification. The behavior analysis applies a dynamic approach with a combination of Run Time Analysis and Resource Monitoring. For malware prediction, there are four areas of malware features which are i) process, ii) file, iii) registry, and iv) network activities. The IF-THEN Prediction Rules which is generated using the data mining technique, ID3 Algorithm is used. In the implementation of malware target classification, Structure Level Rules are utilized to classify malware into possible target class. These three major components are integrated together as a cohesive unit for malware identification through knowledge storage. The experiment on the framework shows that as compared to several other related works, this framework provides better solutions on malware behavior definition, prediction and target classification. From the results, it is proven that the framework can be implemented as one of the security practices to counter the modern malware attacks in a computer environment.
| Item Type: | Thesis (PhD) |
|---|---|
| Additional Information: | Thesis (Doctor of Philosophy in Computer Science) - Universiti Sains Malaysia - 2012 |
| Uncontrolled Keywords: | Malware (Computer software); Computer security |
| Subjects: | Q Science > QA Mathematics > QA76 Computer software T Technology > T Technology (General) |
| Faculty/Division: | Faculty of Computer System And Software Engineering |
| Depositing User: | Ms. Nurul Amanina Lokman |
| Date Deposited: | 23 Aug 2016 01:53 |
| Last Modified: | 19 Aug 2021 05:16 |
| URI: | http://umpir.ump.edu.my/id/eprint/13456 |
| Download Statistic: | View Download Statistics |
Actions (login required)
 |
View Item |