Malicioius Software Detection Using Multiple Sequence Alignment and Data Mining

Malware is currently a major threat to information and computer security, with the volume and growing diversity of its variants causing major problems to traditional security defenses. Software patches and upgrades to anti-viral packages are typically released only after the malware's key characteristics have been identified through infection, by which time it may be too late to protect systems. Multiple sequence analysis is widely used in bioinformatics for revealing the genetic diversity of organisms and annotating gene functions through the identification of common genetic regions. This paper adopts a new approach to the problem of malware recognition, which is to use multiple sequence alignment techniques from bioinformatics to align variable length computer viral and worm code so that core, invariant regions of the code occupy fixed positions in the alignment patterns. Data mining (ANNs, symbolic rule extraction) can then be used to learn the critical features that help to determine into which class the aligned patterns fall. Experimental results demonstrate the feasibility of our novel approach for identifying malware code through multiple sequence alignment followed by analysis by ANNs and symbolic rule extraction methods.