Using Executable Slicing to Improve Rogue Software Detection Algorithms

2. Background

Developing effective potential solutions to the malicious software detection problem is an important direction in host security research. There have been few research papers, (Kang, Poosankam, & Yin, 2007; Perdisci, Lanzi, & Lee, 2008) are good examples, that pose the option of executable slicing while looking at malicious detection. Though their focus is directed toward packed executables, the focus of this paper is to show that statically analyzing sections or slices of an executable will improve prediction rates of non-packed, stand-alone executables. It is important to understand the methods and techniques that are used for these predictions. Since the randomized projection technique in this solution is used in conjunction with an information retrieval prediction algorithm we will include a small background on information retrieval as well as static analysis.