A quantitative study of accuracy in system call-based malware detection - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2012

A quantitative study of accuracy in system call-based malware detection

Résumé

Over the last decade, there has been a significant increase in the number and sophistication of malware-related attacks and infections. Many detection techniques have been proposed to mitigate the malware threat. A running theme among existing detection techniques is the similar promises of high detection rates, in spite of the wildly different models (or specification classes) of malicious activity used. In addition, the lack of a common testing methodology and the limited datasets used in the experiments make difficult to compare these models in order to determine which ones yield the best detection accuracy. In this paper, we present a systematic approach to measure how the choice of behavioral models influences the quality of a malware detector. We tackle this problem by executing a large number of testing experiments, in which we explored the parameter space of over 200 different models, corresponding to more than 220 million of signatures. Our results suggest that commonly held beliefs about simple models are incorrect in how they relate changes in complexity to changes in detection accuracy. This implies that accuracy is non-linear across the model space, and that analytical reasoning is insufficient for finding an optimal model, and has to be supplemented by testing and empirical measurements.

Domaines

Informatique
Fichier principal
Vignette du fichier
rs-publi-3741.pdf (433.47 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-00727280 , version 1 (03-09-2012)

Identifiants

Citer

Davide Canali, Andrea Lanzi, Davide Balzarotti, Christopher Kruegel, Mihai Christodorescu, et al.. A quantitative study of accuracy in system call-based malware detection. International Symposium on Software Testing and Analysis, Jul 2012, Minneapolis, MN, United States. pp.122--132, ⟨10.1145/04000800.2336768⟩. ⟨hal-00727280⟩

Collections

EURECOM
172 Consultations
840 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More