Maximal frequent sub-graph mining for malware detection

Abstract

Malware detection has been one of the current computer security topics of great interest. Traditional signature-based malware detection fails to detect variants of known malware or previously unseen malware. To deal with this issue, machine learning and data mining methods have been widely used to counter the obfuscation techniques of attackers by examining the underlying behavior of suspected malware. However, these methods still suffer from the large number of extracted features and the lack of precise specifications which affects badly scanning time and the accuracy of the malware detection process. In this paper, we present an automatic detection method based on graph mining techniques. Maximal frequent subgraphs in a set of code graphs, representing common behaviors with precise specifications in execution files, are extracted and used as features to generate semantic signatures. These semantic signatures are represented by a set of learning models and employed to distinguish malware programs from benign. Experimental results indicate that our method extracts a limited number of interesting features and achieves effective malware detection.