Skip to content
Research Article Open access CC BY 3.0

Enhancing Malware Detection Accuracy through Graph Based Model

K. Muthumanickam, E. Ilavarasan

Journal of Advances in Mathematics and Computer Science · pp. 2237–2250 · Published 13 Jun 2014

10.9734/BJMCS/2014/10722

Abstract

Malicious malware is a serious threat to end-user in the Internet. Run-time analysis of a program execution behavior is widely used to classify malware’s activities especially when its signature is not obtainable. Towards this end, most of the existing run-time malware detection techniques make use of the information available in the Application Programming Interface call sequence in Windows platform. This paper suggests a novel malware revealing model based on graph model by capturing system calls during the execution of a suspected executable. The implementation results confirm that the proposed call graph model has better detection accuracy rate and also solves the scalability problem when it is compared to existing methods.

Graph model isomorphism malware virtualization

References (27)

  1. 1 gSpan: graph-based substructure pattern mining [DOI]
  2. 2 Data mining methods for detection of new malicious executables [DOI]
  3. 3 Limits of Static Analysis for Malware Detection [DOI]
  4. 4 Semantics-aware malware detection [DOI]
  5. 5 Approximate graph edit distance computation by means of bipartite graph matching [DOI]
  6. 6 Learning and Classification of Malware Behavior [DOI]
  7. 7 Computer viruses—theory and experiments
  8. 8 Automated Classification and Analysis of Internet Malware [DOI]
  9. 9 A new algorithm for error-tolerant subgraph isomorphism detection [DOI]
  10. 10 Large-scale malware indexing using function-call graphs [DOI]
  11. 11 Graph-based malware detection using dynamic analysis [DOI]
  12. 12 Detecting Kernel-Level Rootkits Through Binary Analysis [DOI]
  13. 13 Fast malware classification by automated behavioral graph matching [DOI]
  14. 14 Using spatio-temporal information in API calls with machine learning algorithms for malware detection [DOI]
  15. 15 Network Traffic Analysis and Intrusion Detection Using Packet Sniffer [DOI]
  16. 16 A survey of data mining techniques for malware detection using file features [DOI]
  17. 17 Malware Detection Based on Hybrid Signature Behaviour Application Programming Interface Call Graph [DOI]
  18. 18 Improving the Detection of Malware Behaviour Using Simplified Data Dependent API Call Graph [DOI]
  19. 19 HERO: A novel malware detection framework based on binary translation [DOI]
  20. 20 Semantic Malware Detection by Deploying Graph Mining
  21. 21 A graph‐theoretic framework for isolating botnets in a network [DOI]
  22. 22 Detecting Malicious Behavior Using Critical API-Calling Graph Matching [DOI]
  23. 23 P2P botnet detection based on association between common network behaviors and host behaviors [DOI]
  24. 24 P2P Traffic Identification Based on the Signatures of Key Packets [DOI]
  25. 25 Discovery of Invariant Bot Behavior through Visual Network Monitoring System [DOI]
  26. 26 A New Windows Driver-Hidden Rootkit Based on Direct Kernel Object Manipulation [DOI]
  27. 27 Static Analysis of Executables to Detect Malicious Patterns [DOI]

Cited by 2

A Graph-Based Model for Discovering Host-Based Hook Attacks

P. Pandiaraja, K. Muthumanickam, R. Palani Kumar · Lecture Notes in Networks and Systems · 2023

Showing 1 of 2 known citations — external sources report more than can currently be individually listed.

Related research

Article metrics

Real usage data collected on this platform.

47

Page views

0

PDF downloads

11

Outbound clicks

2

Citations

Views over time

Views by country

Approximate, from request IP at view time — not citizenship or institution. Countries with fewer than 5 views are grouped as "Other".

Traffic sources

Referring site, by host.

Views and downloads exclude known bots/crawlers. Citations combines this platform's own DOI-resolved index with each external source's own reported total — see Cited by above for individually listed citing works. Last refreshed 0 seconds ago.