A framework for malware identification based on behavior

• Main Author: Mohamad Fadli, Zolkipli
• Format: Thesis
• Language: English
• Published: 2012
• Subjects: QA76 Computer software; T Technology (General)
• Online Access: http://umpir.ump.edu.my/id/eprint/13456/1/MOHAMAD%20FADLI%20ZOLKIPLI.pdf; http://umpir.ump.edu.my/id/eprint/13456/

Malware is one of the major security threats in a computer and network environment. Modem malware embeds several techniques in order to complicate malware defence. The current malware issues such as zero-day attacks, malware avoidance techniques and hybrid malware are highlighted. Furthermore, a common approach in malware defence does not provide enough solution to prevent modern malware attacks. Considering the above issues, a new framework for malware identification based on behavior is proposed. This framework consists of three major components; i) behavior analysis, ii) malware prediction and iii) malware target classification. The behavior analysis applies a dynamic approach with a combination of Run Time Analysis and Resource Monitoring. For malware prediction, there are four areas of malware features which are i) process, ii) file, iii) registry, and iv) network activities. The IF-THEN Prediction Rules which is generated using the data mining technique, ID3 Algorithm is used. In the implementation of malware target classification, Structure Level Rules are utilized to classify malware into possible target class. These three major components are integrated together as a cohesive unit for malware identification through knowledge storage. The experiment on the framework shows that as compared to several other related works, this framework provides better solutions on malware behavior definition, prediction and target classification. From the results, it is proven that the framework can be implemented as one of the security practices to counter the modern malware attacks in a computer environment.