UMP Institutional Repository

A framework for malware identification based on behavior

Mohamad Fadli, Zolkipli (2012) A framework for malware identification based on behavior. PhD thesis, Universiti Sains Malaysia.

[img]
Preview
PDF
MOHAMAD FADLI ZOLKIPLI.pdf - Published Version

Download (9MB) | Preview

Abstract

Malware is one of the major security threats in a computer and network environment. Modem malware embeds several techniques in order to complicate malware defence. The current malware issues such as zero-day attacks, malware avoidance techniques and hybrid malware are highlighted. Furthermore, a common approach in malware defence does not provide enough solution to prevent modern malware attacks. Considering the above issues, a new framework for malware identification based on behavior is proposed. This framework consists of three major components; i) behavior analysis, ii) malware prediction and iii) malware target classification. The behavior analysis applies a dynamic approach with a combination of Run Time Analysis and Resource Monitoring. For malware prediction, there are four areas of malware features which are i) process, ii) file, iii) registry, and iv) network activities. The IF-THEN Prediction Rules which is generated using the data mining technique, ID3 Algorithm is used. In the implementation of malware target classification, Structure Level Rules are utilized to classify malware into possible target class. These three major components are integrated together as a cohesive unit for malware identification through knowledge storage. The experiment on the framework shows that as compared to several other related works, this framework provides better solutions on malware behavior definition, prediction and target classification. From the results, it is proven that the framework can be implemented as one of the security practices to counter the modern malware attacks in a computer environment.

Item Type: Thesis (PhD)
Additional Information: Thesis (Doctor of Philosophy in Computer Science) - Universiti Sains Malaysia - 2012
Uncontrolled Keywords: Malware (Computer software); Computer security
Subjects: Q Science > QA Mathematics > QA76 Computer software
T Technology > T Technology (General)
Faculty/Division: Faculty of Computer System And Software Engineering
Depositing User: Ms. Nurul Amanina Lokman
Date Deposited: 23 Aug 2016 01:53
Last Modified: 15 Aug 2017 02:22
URI: http://umpir.ump.edu.my/id/eprint/13456
Download Statistic: View Download Statistics

Actions (login required)

View Item View Item