NDLI: Malicious code forensics based on data mining

Content Provider	IEEE Xplore Digital Library
Author	Xiaohua Li Xiaomei Dong Yulong Wang
Copyright Year	2013
Description	Author affiliation: Sch. of Inf. Sci. & Eng., Northeastern Univ., Shenyang, China (Xiaohua Li; Xiaomei Dong; Yulong Wang)
Abstract	According to the characteristics of electronic evidence generated by malicious codes, a weighted FP-Growth frequent pattern mining algorithm was proposed for malicious code forensics. Different API call sequences were assigned different weights according to their threaten degree to obtain frequent patterns of serious malicious codes and more accurate analysis results. Based on the weighted FP-Growth algorithm, an analysis and forensics method for malicious codes was proposed. By monitoring the malicious code processes, registry, file recording and port number to record its behavior, electronic evidence of malicious codes was obtained and analyzed to generate the forensics report. Compared with the original FP-Growth algorithm, the weighted algorithm can obtain higher accuracy when used for evidence analysis. Specific examples also verified the feasibility of the method and the effect of the host.
Sponsorship	IEEE Circuits Syst. Soc.
Starting Page	978
Ending Page	983
File Size	577646
Page Count	6
File Format	PDF
ISBN	9781467352536
DOI	10.1109/FSKD.2013.6816337
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2013-07-23
Publisher Place	China
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Algorithm design and analysis malicious code Forensics Ports (Computers) data mining Malware Software Data mining API call sequence weighted FP-Growth algorithm computer forensics Monitoring
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Mr. Siddhartha Mukherjee siddhartha@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	ndl-support@iitkgp.ac.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Libarray of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Mining weighted association rules based on weighted Fp tree

Proposal of a Method Detecting Malicious Processes

Malware Detection Systems Based on API Log Data Mining

Malware classification based on API calls and behaviour analysis

MCARTA: A Malicious Code Automated Run-Time Analysis framework

Analyzing Malware by Abstracting the Frequent Itemsets in API Call Sequences

Design of Intrusion Detection Model Based on Data Mining Technology

Behavioural detection with API call-grams to identify malicious PE files

An Evaluation of API Calls Hooking Performance

Malicious code forensics based on data mining

Similar Documents

Mining weighted association rules based on weighted Fp tree

Proposal of a Method Detecting Malicious Processes

Malware Detection Systems Based on API Log Data Mining

Malware classification based on API calls and behaviour analysis

MCARTA: A Malicious Code Automated Run-Time Analysis framework

Analyzing Malware by Abstracting the Frequent Itemsets in API Call Sequences

Design of Intrusion Detection Model Based on Data Mining Technology

Behavioural detection with API call-grams to identify malicious PE files

An Evaluation of API Calls Hooking Performance

Malicious code forensics based on data mining