A malware instruction set for behavior-based analysis


Trinius, Philipp ; Willems, Carsten ; Holz, Thorsten ; Rieck, Konrad


[img]
Preview
PDF
mist.pdf - Published

Download (320kB)

URL: http://ub-madoc.bib.uni-mannheim.de/2579
URN: urn:nbn:de:bsz:180-madoc-25799
Document Type: Working paper
Year of publication: 2009
Publication language: English
Institution: School of Business Informatics and Mathematics > Sonstige - Fakultät für Mathematik und Informatik
MADOC publication series: Veröffentlichungen der Fakultät für Mathematik und Informatik > Institut für Informatik > Technical Reports
Subject: 004 Computer science, internet
Classification: CCS: D.4.6 I.5.0 K.6.5 ,
Subject headings (SWD): Malware
Individual keywords (German): Schadprogramme , Verhaltensanalyse , Dynamische Analyse , Maschinelles Lernen , Vorverarbeitung
Keywords (English): Malicious software , Program behavior , Dynamic analysis , Machine learning , Preprocessing
Abstract: We introduce a new representation for monitored behavior of malicious software called Malware Instruction Set (MIST). The representation is optimized for effective and efficient analysis of behavior using data mining and machine learning techniques. It can be obtained automatically during analysis of malware with a behavior monitoring tool or by converting existing behavior reports. The representation is not restricted to a particular monitoring tool and thus can also be used as a meta language to unify behavior reports of different sources.
Additional information:

Das Dokument wird vom Publikationsserver der Universitätsbibliothek Mannheim bereitgestellt.




+ Citation Example and Export

Trinius, Philipp ; Willems, Carsten ; Holz, Thorsten ; Rieck, Konrad (2009) A malware instruction set for behavior-based analysis. Open Access [Working paper]
[img]
Preview



+ Search Authors in

+ Download Statistics

Downloads per month over past year

View more statistics



You have found an error? Please let us know about your desired correction here: E-Mail


Actions (login required)

Show item Show item