An automated classification system based on the strings of trojan and virus families

Ronghua Tian; Lynn Batten; MD Rafiqul Islam; Steve Versteeg

doi:10.1109/MALWARE.2009.5403021

An automated classification system based on the strings of trojan and virus families

Ronghua Tian, Lynn Batten, MD Rafiqul Islam, Steve Versteeg

Research output: Book chapter/Published conference paper › Conference paper › peer-review

98 Citations (Scopus)

Abstract

Classifying malware correctly is an important research issue for anti-malware software producers. This paper presents an effective and efficient malware classification technique based on string information using several well-known classification algorithms. In our testing we extracted the printable strings from 1367 samples, including unpacked trojans and viruses and clean files. Information describing the printable strings contained in each sample was input to various classification algorithms, including tree-based classifiers, a nearest neighbour algorithm, statistical algorithms and AdaBoost. Using k-fold cross validation on the unpacked malware and clean files, we achieved a classification accuracy of 97%. Our results reveal that strings from library code (rather than malicious code itself) can be utilised to distinguish different malware families.

Original language	English
Title of host publication	MALWARE 2009
Subtitle of host publication	4th proceedings
Place of Publication	United States
Publisher	Institute of Electrical and Electronics Engineers
Pages	23-30
Number of pages	8
ISBN (Electronic)	9781424457878
DOIs	https://doi.org/10.1109/MALWARE.2009.5403021
Publication status	Published - 2009
Event	International Conference on Malicious and Unwanted Software (MALWARE) - Montreal, QC, Canada, Canada Duration: 13 Oct 2009 → 14 Oct 2009

Conference

Conference	International Conference on Malicious and Unwanted Software (MALWARE)
Country/Territory	Canada
Period	13/10/09 → 14/10/09

Access to Document

10.1109/MALWARE.2009.5403021

Cite this

@inproceedings{98c2970e96dd4b688141d0d84c8c419b,

title = "An automated classification system based on the strings of trojan and virus families",

abstract = "Classifying malware correctly is an important research issue for anti-malware software producers. This paper presents an effective and efficient malware classification technique based on string information using several well-known classification algorithms. In our testing we extracted the printable strings from 1367 samples, including unpacked trojans and viruses and clean files. Information describing the printable strings contained in each sample was input to various classification algorithms, including tree-based classifiers, a nearest neighbour algorithm, statistical algorithms and AdaBoost. Using k-fold cross validation on the unpacked malware and clean files, we achieved a classification accuracy of 97%. Our results reveal that strings from library code (rather than malicious code itself) can be utilised to distinguish different malware families.",

keywords = "AdaBoost, Anti-malware, Automated classification systems, Classification accuracy, Classification algorithm, Classification technique, Cross validation, Library codes, Malicious codes, Malwares, Nearest neighbour, Research issues, Statistical algorithm, Tree-based, Trojans",

author = "Ronghua Tian and Lynn Batten and Islam, {MD Rafiqul} and Steve Versteeg",

note = "Imported on 02 May 2017 - DigiTool details were: publisher = United States: Institute of Electrical and Electronics Engineers, 2009. Event dates (773o) = 13-14 Oct. 2009; Parent title (773t) = International Conference on Malicious and Unwanted Software (MALWARE).; International Conference on Malicious and Unwanted Software (MALWARE) ; Conference date: 13-10-2009 Through 14-10-2009",

year = "2009",

doi = "10.1109/MALWARE.2009.5403021",

language = "English",

pages = "23--30",

booktitle = "MALWARE 2009",

publisher = "Institute of Electrical and Electronics Engineers",

}

Tian, R, Batten, L, Islam, MDR & Versteeg, S 2009, An automated classification system based on the strings of trojan and virus families. in MALWARE 2009: 4th proceedings. Institute of Electrical and Electronics Engineers, United States, pp. 23-30, International Conference on Malicious and Unwanted Software (MALWARE), Canada, 13/10/09. https://doi.org/10.1109/MALWARE.2009.5403021

TY - GEN

T1 - An automated classification system based on the strings of trojan and virus families

AU - Tian, Ronghua

AU - Batten, Lynn

AU - Islam, MD Rafiqul

AU - Versteeg, Steve

N1 - Imported on 02 May 2017 - DigiTool details were: publisher = United States: Institute of Electrical and Electronics Engineers, 2009. Event dates (773o) = 13-14 Oct. 2009; Parent title (773t) = International Conference on Malicious and Unwanted Software (MALWARE).

PY - 2009

Y1 - 2009

N2 - Classifying malware correctly is an important research issue for anti-malware software producers. This paper presents an effective and efficient malware classification technique based on string information using several well-known classification algorithms. In our testing we extracted the printable strings from 1367 samples, including unpacked trojans and viruses and clean files. Information describing the printable strings contained in each sample was input to various classification algorithms, including tree-based classifiers, a nearest neighbour algorithm, statistical algorithms and AdaBoost. Using k-fold cross validation on the unpacked malware and clean files, we achieved a classification accuracy of 97%. Our results reveal that strings from library code (rather than malicious code itself) can be utilised to distinguish different malware families.

AB - Classifying malware correctly is an important research issue for anti-malware software producers. This paper presents an effective and efficient malware classification technique based on string information using several well-known classification algorithms. In our testing we extracted the printable strings from 1367 samples, including unpacked trojans and viruses and clean files. Information describing the printable strings contained in each sample was input to various classification algorithms, including tree-based classifiers, a nearest neighbour algorithm, statistical algorithms and AdaBoost. Using k-fold cross validation on the unpacked malware and clean files, we achieved a classification accuracy of 97%. Our results reveal that strings from library code (rather than malicious code itself) can be utilised to distinguish different malware families.

KW - AdaBoost

KW - Anti-malware

KW - Automated classification systems

KW - Classification accuracy

KW - Classification algorithm

KW - Classification technique

KW - Cross validation

KW - Library codes

KW - Malicious codes

KW - Malwares

KW - Nearest neighbour

KW - Research issues

KW - Statistical algorithm

KW - Tree-based

KW - Trojans

U2 - 10.1109/MALWARE.2009.5403021

DO - 10.1109/MALWARE.2009.5403021

M3 - Conference paper

SP - 23

EP - 30

BT - MALWARE 2009

PB - Institute of Electrical and Electronics Engineers

CY - United States

T2 - International Conference on Malicious and Unwanted Software (MALWARE)

Y2 - 13 October 2009 through 14 October 2009

ER -

An automated classification system based on the strings of trojan and virus families

Abstract

Conference

Access to Document

Fingerprint

Cite this