Malware Detection Using a Heterogeneous Distance Function

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21240%2F18%3A00324209" target="_blank" >RIV/68407700:21240/18:00324209 - isvavai.cz</a>

Result on the web

<a href="http://www.cai.sk/ojs/index.php/cai/index" target="_blank" >http://www.cai.sk/ojs/index.php/cai/index</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.4149/cai_2018_3_759" target="_blank" >10.4149/cai_2018_3_759</a>

Result language

angličtina

Original language name

Malware Detection Using a Heterogeneous Distance Function

Original language description

Classication of automatically generated malware is an active research area. The amount of new malware is growing exponentially and since manual in- vestigation is not possible, automated malware classication is necessary. In this paper, we present a static malware detection system for the detection of unknown malicious programs which is based on combination of the weighted k-nearest neigh- bors classier and the statistical scoring technique from. We have extracted the most relevant features from portable executable (PE) le format using gain ratio and have designed a heterogeneous distance function that can handle both linear and nominal features. Our proposed detection method was evaluated on a dataset with tens of thousands of malicious and benign samples and the experimental re- sults show that the accuracy of our classier is 98.80%. In addition, preliminary results indicate that the proposed similarity metric on our feature space could be used for clustering malware into families.

Czech name

—

Czech description

—

Type

J_imp - Article in a specialist periodical, which is included in the Web of Science database

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

—

Continuities

S - Specificky vyzkum na vysokych skolach

Publication year

2018

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Name of the periodical

Computing and Informatics

ISSN

1335-9150

e-ISSN

—

Volume of the periodical

37

Issue of the periodical within the volume

3

Country of publishing house

SK - SLOVAKIA

Number of pages

22

Pages from-to

759-780

UT code for WoS article

000441238100011

EID of the result in the Scopus database

—