As a guest user you are not logged in or recognized by your IP address. You have
access to the Front Matter, Abstracts, Author Index, Subject Index and the full
text of Open Access publications.
The best way to detect new malware or their variants is malware classification. Static and dynamic analysis are most common ways for malware classification. Dynamic analysis is behavior based analysis approach, analysts perform malware in a sandbox (usually in a virtual machine) to observe their behavior. Static analysis is signature based analysis approach, analysts either applies reverse engineering approach or analyses binary code directly to get the signatures of malware. While deployment of honeypot in organizations have become popular, more and more malware which contain source codes and binary files could be captured. Most existing malware analysis approaches focused on analyzing of only single binary file that do not suitable for malware captured by honeypot. Therefore, a classification system for honeypot captured malware is needed in organizations. Moreover, as the number of captured malware increases, analysis and forensics become a new challenge. For IT security staff, how to identify which malware is new or serious attack which needs advanced analysis, and which malware is out-of-date attack which could be ignored from a great volume of captured malware is a critical issue.
In paper, a novel classification approach for honeypot captured malware is proposed. The proposed approach analyzes features extracted from file structure of malware, file name, malware source code and binary file. An efficient incremental cluster algorithm is developed to replace traditional hierarchical clustering algorithm for clustering malware.
This website uses cookies
We use cookies to provide you with the best possible experience. They also allow us to analyze user behavior in order to constantly improve the website for you. Info about the privacy policy of IOS Press.
This website uses cookies
We use cookies to provide you with the best possible experience. They also allow us to analyze user behavior in order to constantly improve the website for you. Info about the privacy policy of IOS Press.