Study of Common Sub-graphs of System Call Dependency Graphs for Malware Classification - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Mémoires D'étudiants -- Hal-Inria+ Année : 2018

Study of Common Sub-graphs of System Call Dependency Graphs for Malware Classification

Étude des sous-graphes communs des Graphes de Dépendance d’Appels Systèmes pour la classification de logiciels malveillants

Résumé

Distinguishing legitimate software from malicious software is a problem that requires a lot of expertise. In order to create a malware detection software, an approach consists in extracting System Call Dependency Graphs (SCDG) which summarize the behavior of a software. Once SCDGs are extracted, a learning phase identifies sub-graphs characteristic of malicious behaviors. In order to classify the graph of an unknown binary, we look whether it contains such sub-graphs. These techniques proved to be efficient, but no analysis of the sub-graphs extracted during the learning phase has been conducted so far. We study the sub-graphs we find and showcase preprocessing steps on the graphs in order to improve the learning and classification performance. The approach has been applied on graphs extracted from Mirai. Mirai is a malware which created a large botnet in 2016 to perform distributed deny of service attacks. We show that the preprocessing step tremendously improve the speed of the learning and classification.
Fichier principal
Vignette du fichier
2018_Marinho_internship.pdf (341.65 Ko) Télécharger le fichier
V2preprocess.pdf (16.66 Ko) Télécharger le fichier
exampleSCDG.pdf (10.49 Ko) Télécharger le fichier
limitsSCDG.pdf (11.47 Ko) Télécharger le fichier
scArgMotivation.pdf (10.82 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03147651 , version 1 (22-02-2021)

Licence

Paternité - Pas d'utilisation commerciale - Pas de modification

Identifiants

  • HAL Id : hal-03147651 , version 1

Citer

Dylan Marinho. Study of Common Sub-graphs of System Call Dependency Graphs for Malware Classification. Computer Science [cs]. 2018. ⟨hal-03147651⟩
75 Consultations
342 Téléchargements

Partager

Gmail Facebook X LinkedIn More