Using Executable Slicing to Improve Rogue Software Detection Algorithms

Using Executable Slicing to Improve Rogue Software Detection Algorithms

Jan Durand (Louisiana Tech University, USA), Juan Flores (Louisiana Tech University, USA), Travis Atkison (Louisiana Tech University, USA), Nicholas Kraft (University of Alabama, USA) and Randy Smith (University of Alabama, USA)
Copyright: © 2013 |Pages: 12
DOI: 10.4018/978-1-4666-2482-5.ch007

Abstract

This paper describes a research effort to use executable slicing as a pre-processing aid to improve the prediction performance of rogue software detection. The prediction technique used here is an information retrieval classifier known as cosine similarity that can be used to detect previously unknown, known or variances of known rogue software by applying the feature extraction technique of randomized projection. This paper provides direction in answering the question of is it possible to only use portions or subsets, known as slices, of an application to make a prediction on whether or not the software contents are rogue. This research extracts sections or slices from potentially rogue applications and uses these slices instead of the entire application to make a prediction. Results show promise when applying randomized projections to cosine similarity for the predictions, with as much as a 4% increase in prediction performance and a five-fold decrease in processing time when compared to using the entire application.
Chapter Preview
Top

2. Background

Developing effective potential solutions to the malicious software detection problem is an important direction in host security research. There have been few research papers, (Kang, Poosankam, & Yin, 2007; Perdisci, Lanzi, & Lee, 2008) are good examples, that pose the option of executable slicing while looking at malicious detection. Though their focus is directed toward packed executables, the focus of this paper is to show that statically analyzing sections or slices of an executable will improve prediction rates of non-packed, stand-alone executables. It is important to understand the methods and techniques that are used for these predictions. Since the randomized projection technique in this solution is used in conjunction with an information retrieval prediction algorithm we will include a small background on information retrieval as well as static analysis.

Complete Chapter List

Search this Book:
Reset