Graph theoretical method for quickly and accurately detecting zero-day malicious software

Abstract

The invention discloses a graph theoretical method MalZero for quickly and accurately detecting zero-day malicious software. The method is characterized in that features are extracted from API calling graphs to establish a classifier model, benign software and malicious software have different graph theoretical properties in respective API calling graphs, and the graph theoretical features extracted from the API calling graphs can be used for distinguishing the malicious software from the benign software effectively and efficiently. Three modules, namely a graph construction module, a feature extraction module and a graph classification module are involved in the method. Through the MalZero, the malicious software can be quickly and accurately detected on a terminal host, high efficiency is achieved in terms of storage space and detection time, and the MalZero can supplement an existing malicious software detection scheme of the terminal host due to low overhead.

Description

technical field [0001] The invention relates to the field of computers, in particular to a graph theory method for quickly and accurately detecting zero-day malware. Background technique [0002] According to the threat report released by "PandaLabs", an average of 73,000 new types of malicious attack programs are released every day [1]. A recent research report on vulnerability databases shows that about 90% of software vulnerabilities are exploited by malware at the time of release [19]. Malware detection is difficult because signatures of new (or unknown in advance) malware are not available at the time the malware starts. Malware detection has to focus on end hosts because network-based security appliances, such as firewalls and intrusion detection and prevention systems, rely primarily on malware signatures, and signature-based detection methods can hardly detect new malware. Existing antivirus software available on end hosts relies on signature-based malware detectio...

AI Technical Summary

Problems solved by technology

Sequence-based approaches are efficient, but are vulnerable to obfuscation like garbage insertion and reordering

Images