Authors:
Byoungkoo Kim
1
;
Ikkyun Kim
2
and
Tai-Myoung Chung
3
Affiliations:
1
Electronics and Teletcommunicatons Research Institute and Sungkyunkwan University, Korea, Republic of
;
2
Electronics and Teletcommunicatons Research Institute, Korea, Republic of
;
3
Sungkyunkwan University, Korea, Republic of
Keyword(s):
Network Packet, Malware Detection, Region Analysis, Executable File.
Related
Ontology
Subjects/Areas/Topics:
Information and Systems Security
;
Network Security
;
Secure Software Development Methodologies
;
Security in Information Systems
;
Security Information Systems Architecture and Design and Security Patterns
;
Wireless Network Security
Abstract:
The injury by various computer viruses is over the time comprised of the tendency to increase. Therefore, various methodologies for protecting the computer system from the threats of new malicious software are actively studied. In this paper, we present a network-based executable file extraction and analysis technique for malware detection. Here, an executable file extraction is processed by executable file specific session and pattern matching in reconfiguring hardware. Next, malware detection is processed by clustering analysis technique about an executable file which is divided into many regions. In other words, it detects a malware by measuring the byte distribution similarity between malicious executable files and normal executable files. The proposed technique can detect not only the known malicious software but also the unknown malicious software. Most of all, it uses network packets as analysis source unlike the existing host anti-virus techniques. Besides, the proposed detec
tion technique easily can detect malicious software without complicated command analysis. Therefore, our approach can minimize the load on the system execution despite the load on the additional network packet processing.
(More)