Distributed Malware Detection based on Binary File Features in Cloud Computing Environment
作者单位：School of Computer & Communication EngineeringUniversity of Science & Technology Beijing
会议名称：《第26届中国控制与决策会议》
会议日期：2014年
学科分类：08[工学] 0835[工学-软件工程] 081202[工学-计算机软件与理论] 0812[工学-计算机科学与技术（可授工学、理学学位）]
基 金：supported by National Nature Science Foundation under Grant60875029 61035004
关 键 词：Data Mining Malware Detection Malware Images Distributed Entropy LSH
摘 要：A number of techniques have been devised by researchers to counter malware attacks, and machine learning techniques play an important role in automated malware detection. Several machine learning approaches have been applied to malware detection, based on different features derived from dynamic analysis of the malware. While these methods demonstrate promise, they pose at least two major challenges. First, these approaches are subjected to a growing array of countermeasures that increase the cost of capturing these malware binary executable file features. Further, feature extraction requires a time investment per binary file that does not scale well to the daily volume of malware instances being reported by those who diligently collect malware. In order to address the first challenge, this article proposed a binary-to-image projection algorithm based on a new type of feature extraction for the malware, was introduced in [2]. To address the second challenge, the technique’s scalability is demonstrated through an implementation for the distributed（Key, Value） abstraction in cloud computing environment. Both theoretical and empirical evidence demonstrate its effectiveness over other state-of-the-art malware detection techniques on malware corpus, and the proposed method could be a useful and efficient complement to dynamic analysis.