Discriminant malware distance learning on structural information for automated malware classification

Deguang Kong; Guanhua Yan

doi:10.1145/2494232.2465531

Discriminant malware distance learning on structural information for automated malware classification

Deguang Kong
, Guanhua Yan

School of Computing

Binghamton University

University of Texas at Arlington

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

22 Scopus citations

Abstract

In this work, we explore techniques that can automatically classify malware variants into their corresponding families. Our framework extracts structural information from malware programs as attributed function call graphs, further learns discriminant malware distance metrics, finally adopts an ensemble of classifiers for automated malware classification. Experimental results show that our method is able to achieve high classification accuracy.

Original language	English
Title of host publication	SIGMETRICS 2013 - Proceedings of the 2013 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems
Pages	347-348
Number of pages	2
Edition	1 SPEC. ISS.
DOIs	https://doi.org/10.1145/2494232.2465531
State	Published - 2013
Event	2013 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems, SIGMETRICS 2013 - Pittsburgh, PA, United States Duration: Jun 17 2013 → Jun 21 2013

Publication series

Name	Performance Evaluation Review
Number	1 SPEC. ISS.
Volume	41

Conference

Conference	2013 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems, SIGMETRICS 2013
Country/Territory	United States
City	Pittsburgh, PA
Period	06/17/13 → 06/21/13

Keywords

Distance learning
Malware categorization

Access to Document

10.1145/2494232.2465531

Cite this

Kong, D., & Yan, G. (2013). Discriminant malware distance learning on structural information for automated malware classification. In SIGMETRICS 2013 - Proceedings of the 2013 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (1 SPEC. ISS. ed., pp. 347-348). (Performance Evaluation Review; Vol. 41, No. 1 SPEC. ISS.). https://doi.org/10.1145/2494232.2465531

@inproceedings{63d807dd07964aa1a1291be7d75ff53e,

title = "Discriminant malware distance learning on structural information for automated malware classification",

abstract = "In this work, we explore techniques that can automatically classify malware variants into their corresponding families. Our framework extracts structural information from malware programs as attributed function call graphs, further learns discriminant malware distance metrics, finally adopts an ensemble of classifiers for automated malware classification. Experimental results show that our method is able to achieve high classification accuracy.",

keywords = "Distance learning, Malware categorization",

author = "Deguang Kong and Guanhua Yan",

year = "2013",

doi = "10.1145/2494232.2465531",

language = "English",

isbn = "9781450319003",

series = "Performance Evaluation Review",

number = "1 SPEC. ISS.",

pages = "347--348",

booktitle = "SIGMETRICS 2013 - Proceedings of the 2013 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems",

edition = "1 SPEC. ISS.",

note = "2013 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems, SIGMETRICS 2013 ; Conference date: 17-06-2013 Through 21-06-2013",

}

Kong, D & Yan, G 2013, Discriminant malware distance learning on structural information for automated malware classification. in SIGMETRICS 2013 - Proceedings of the 2013 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems. 1 SPEC. ISS. edn, Performance Evaluation Review, no. 1 SPEC. ISS., vol. 41, pp. 347-348, 2013 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems, SIGMETRICS 2013, Pittsburgh, PA, United States, 06/17/13. https://doi.org/10.1145/2494232.2465531

Discriminant malware distance learning on structural information for automated malware classification. / Kong, Deguang; Yan, Guanhua.
SIGMETRICS 2013 - Proceedings of the 2013 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems. 1 SPEC. ISS. ed. 2013. p. 347-348 (Performance Evaluation Review; Vol. 41, No. 1 SPEC. ISS.).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Discriminant malware distance learning on structural information for automated malware classification

AU - Kong, Deguang

AU - Yan, Guanhua

PY - 2013

Y1 - 2013

N2 - In this work, we explore techniques that can automatically classify malware variants into their corresponding families. Our framework extracts structural information from malware programs as attributed function call graphs, further learns discriminant malware distance metrics, finally adopts an ensemble of classifiers for automated malware classification. Experimental results show that our method is able to achieve high classification accuracy.

AB - In this work, we explore techniques that can automatically classify malware variants into their corresponding families. Our framework extracts structural information from malware programs as attributed function call graphs, further learns discriminant malware distance metrics, finally adopts an ensemble of classifiers for automated malware classification. Experimental results show that our method is able to achieve high classification accuracy.

KW - Distance learning

KW - Malware categorization

UR - https://www.scopus.com/pages/publications/84880215136

U2 - 10.1145/2494232.2465531

DO - 10.1145/2494232.2465531

M3 - Conference contribution

SN - 9781450319003

T3 - Performance Evaluation Review

SP - 347

EP - 348

BT - SIGMETRICS 2013 - Proceedings of the 2013 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems

T2 - 2013 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems, SIGMETRICS 2013

Y2 - 17 June 2013 through 21 June 2013

ER -

Discriminant malware distance learning on structural information for automated malware classification

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this