By Topic

Behavior-Based Tracer to Monitor Malicious Features of Unknown Executable File

Sign In

Cookies must be enabled to login.After enabling cookies , please use refresh or reload or ctrl+f5 on the browser for the login options.

Formats Non-Member Member
$33 $13
Learn how you can qualify for the best price for this item!
Become an IEEE Member or Subscribe to
IEEE Xplore for exclusive pricing!
close button

puzzle piece

IEEE membership options for an individual and IEEE Xplore subscriptions for an organization offer the most affordable access to essential journal articles, conference papers, standards, eBooks, and eLearning courses.

Learn more about:

IEEE membership

IEEE Xplore subscriptions

4 Author(s)
Daewon Kim ; Knowledge-based Inf. Security & Safely Res. Dept., Electron. & Telecommun. Res. Inst., Daejeon, South Korea ; Ikkyun Kim ; Jintae Oh ; Jongsoo Jang

In computing environments, the core of various security threats is malicious executable files. Conventional signature-based security systems are difficult to detect, at run-time, the unknowns among malicious executable files. For the reason, the static and dynamic analysis methods that the signatures are not required have been actively researched for run-time detection of the unknowns. In particular, the behavior-based dynamic analysis methods which monitor the action statuses, after the actual running of malicious executable file, have made a worthy contribution for the accuracy enhancement of analysis result. However, the analysis information which is offered by most behavior-based methods is not sufficient for applying the results to the methods which finally decide the malignancy of executable file because each behavior-based methods offer only the results of a few action or non-sequential analysis. In this paper, we classified the activities that may be occurred during the execution of malicious executable files and described the implementation of prototype program which can monitor the activities. Additionally, based on operation results of the prototype program, we discussed some important issues which are occurred due to the differences of real and virtual experimental environments.

Published in:

Computing in the Global Information Technology (ICCGI), 2010 Fifth International Multi-Conference on

Date of Conference:

20-25 Sept. 2010