A New Malware Attack Pattern Generalization

• Main Authors: Yusof, R., Selamat, S. R., Sahib, S., Abdollah, M. F., Mas'ud, M. Z., Ramly, M.
• Format: Conference or Workshop Item
• Language: English
• Published: 2011
• Subjects: Q Science (General)
• Online Access: http://eprints.utem.edu.my/id/eprint/190/1/Generic_Malware_Attack_Pattern.docx; http://eprints.utem.edu.my/id/eprint/190/

The significant threats of malware are still continuing due to their rapid distribution nature on the internet. The malware attack pattern from nine different attack scenarios have been extracted from various logs at different OSI layers such as victim logs, attacker logs and IDS alert log. These malware attack pattern are further analyzed to form the general malware attack pattern which describes the process of malware infection. This paper proposes a general attack pattern for malware in three different perspectives which is attacker, victim and victim/attacker or multi-step attack using only traditional worm variant. Hence, the general malware attack pattern can be extended into research areas in alert correlation and computer forensic investigation.