Malware Detection Module using Machine Learning Algorithms to Assist in Centralized Security in Enterprise Networks

Priyank Singhal

doi:10.5121/ijnsa.2012.4106

Abstract

Malicious software is abundant in a world of innumerable computer users, who are constantly faced with these threats from various sources like the internet, local networks and portable drives. Malware is potentially low to high risk and can cause systems to function incorrectly, steal data and even crash. Malware may be executable or system library files in the form of viruses, worms, Trojans, all aimed at breaching the security of the system and compromising user privacy. Typically, anti-virus software is based on a signature definition system which keeps updating from the internet and thus keeping track of known viruses. While this may be sufficient for home-users, a security risk from a new virus could threaten an entire enterprise network. This paper proposes a new and more sophisticated antivirus engine that can not only scan files, but also build knowledge and detect files as potential viruses. This is done by extracting system API calls made by various normal and harmful executable, and using machine learning algorithms to classify and hence, rank files on a scale of security risk. While such a system is processor heavy, it is very effective when used centrally to protect an enterprise network which maybe more prone to such threats.

Highlights

IntroductionShort for malicious software, consists of programming (code, scripts, active content, and other software) designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, gain unauthorized access to system resources, and other abusive behaviour [1]
Malware, short for malicious software, consists of programming designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, gain unauthorized access to system resources, and other abusive behaviour [1]
This paper proposes a new and more sophisticated antivirus engine that can scan files, and build knowledge and detect files as potential viruses

Summary

Introduction

Short for malicious software, consists of programming (code, scripts, active content, and other software) designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, gain unauthorized access to system resources, and other abusive behaviour [1]. Worms, Trojan horses, spyware, dishonest adware, crime-ware, most rootkits, and other malicious and unwanted software or program [2]. According to F-Secure, "As much malware produced in 2007 as in the previous 20 years altogether.” [3]. While these may mean nothing to the average home user, these statistics are alarming keeping. Since 2003, the majority of widespread viruses and worms have been designed to take control of users' computers for black-market exploitation. Another category of malware, spyware, - programs designed to monitor users' web browsing and steal private information. There is a very urgent need to find, not just a suitable method to detect infected files, but too build a smart engine that can detect new viruses by studying the structure of system calls made by malware

Current Antivirus Software

Our Approach

Obtained Results

Conclusion