Novel Malware Clustering System Based on Kernel Data Structure

Apply

Novel Malware Clustering System Based on Kernel Data Structure

Journal Title: IOSR Journals (IOSR Journal of Computer Engineering) - Year 2015, Vol 17, Issue 6

Abstract

Abstract : An operating system kernel is the prime of system software, responsible for the integrity and conventional computer system’s operations. Traditional malware detection approaches have based on the codecentricaspects of malicious programs, e.g. injection of unauthorized code or the control flow patterns of malware programs. In response to these malware detection strategies, modern malware focus on advanced techniques such as reusing existing code or complicated malware code to circumvent detection. A new perspective is introduced to detect malware which is different from code-centric approaches. The data centric malware defense architecture (DMDA) is introduced which models and detects malware behavior. This architecture is based on properties of the kernel data objects that are targeted during malware attacks. This architecture requires external monitoring. External monitor resides outside the monitored kernel and ensures temper-resistance. This architecture consists of three core system components that enable inspection of the kernel data properties and depending upon these properties from malware cluster. The system clusters malware depending upon the kernel data objects.

Authors and Affiliations

Bhandare Trupti Vasantrao , Pramod B. Mali

Keywords

EP ID EP128051
DOI -
Views 126
Downloads 0