Implementnig Data Mining for Detection of Malware from Code

Abstract

In this paper we discuss various data mining techniques that we have successfully applied for cyber security. This research investigates the use of data mining methods for malware (malicious programs) detection and proposed a framework as an alternative to the traditional signature detection methods. These applications include malicious code detection by mining binary executables by anomaly detection, and data stream mining. A serious security threat today is malicious executables, especially new, unseen malicious executables often arriving as email attachments. These new malicious executables are created at the rate of thousands every year and pose a serious security threat. Our research is closely related to information retrieval and classification techniques and borrows a number of ideas from the field. Current anti-virus systems attempt to detect these new malicious programs with heuristics generated by hand. This approach is costly and oftentimes ineffective. We present a data-mining framework that detects new, previously unseen malicious executables accurately and automatically. The data -mining framework automatically found patterns in our data set and used these patterns to detect a set of new malicious binaries. Comparing our detection methods with a traditional signature based method; this method is more than doubles the current detection rates for new malicious executables.