Logo image
Back
Multi-channel Change-Point Malware Detection
Conference proceeding   Open access

Multi-channel Change-Point Malware Detection

Raymond Canzanese, Moshe Kam, Spiros Mancoridis and IEEE
2013 IEEE 7th International Conference on Software Security and Reliability
Jun 2013
DOI: https://doi.org/10.1109/SERE.2013.20
url
https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6754775View
Accepted (AM) Open Open Access (License Unspecified)

Abstract

behavioral detection change detection change-point detection Detectors Feature extraction Malware multi-channel quickest detection Sensor phenomena and characterization Software Virtual machine monitors
The complex computing systems employed by governments, corporations, and other institutions are frequently targeted by cyber-attacks designed for espionage and sabotage. The malicious software used in such attacks are typically custom-designed or obfuscated to avoid detection by traditional antivirus software. Our goal is to create a malware detection system that can quickly and accurately detect such otherwise difficult-to-detect malware. We pose the problem of malware detection as a multi-channel change-point detection problem, wherein the goal is to identify the point in time when a system changes from a known clean state to an infected state. We present a host-based malware detection system designed to run at the hypervisor level, monitoring hypervisor and guest operating system sensors and sequentially determining whether the host is infected. We present a case study wherein the detection system is used to detect various types of malware on an active web server under heavy computational load.

Metrics

3 Record Views
5 citations in Web of Science
6 citations in Scopus

Details

InCites Highlights

Data related to this publication, from InCites Benchmarking & Analytics tool:

Web of Science research areas
Computer Science, Software Engineering
Computer Science, Theory & Methods
Engineering, Electrical & Electronic
Logo image