Home

Data Mining Methods for Detection of New Malicious Executables

Matthew G. Schultz; Eleazar Eskin; Erez Zadok; Salvatore Stolfo

Title:
Data Mining Methods for Detection of New Malicious Executables
Author(s):
Schultz, Matthew G.; Eskin, Eleazar; Zadok, Erez; Stolfo, Salvatore
Date:
Type:
Articles
Department:
Computer Science
Permanent URL:
Notes:
2001 IEEE Symposium on Security and Privacy: S amp; P 2001: proceedings: 14-16 May, 2001, Oakland, California (Los Alamitos, Calif.: IEEE Computer Society, 2001), pp. 38-49.
Abstract:
A serious security threat today is malicious executables, especially new, unseen malicious executables often arriving as email attachments. These new malicious executables are created at the rate of thousands every year and pose a serious security threat. Current anti-virus systems attempt to detect these new malicious programs with heuristics generated by hand. This approach is costly and oftentimes ineffective. We present a data mining framework that detects new, previously unseen malicious executables accurately and automatically. The data mining framework automatically found patterns in our data set and used these patterns to detect a set of new malicious binaries. Comparing our detection methods with a traditional signature-based method, our method more than doubles the current detection rates for new malicious executables.
Subject(s):
Computer science
Publisher DOI:
http://dx.doi.org/10.1109/SECPRI.2001.924286
Item views:
321
Metadata:
text | xml

In Partnership with the Center for Digital Research and Scholarship at Columbia University Libraries/Information Services | Terms of Use