Abstract

Malware refers to any type of code written with the intention of harming a computer or network. The quantity of malware being produced is increasing every year and poses a serious global security threat. Hence, malware detection is a critical topic in computer security. Signature-based detection is the most widespread method used in commercial antivirus solutions. However, signature-based detection can detect malware only once the malicious executable has caused damage and has been conveniently registered and documented. Therefore, the signature-based method fails to detect obfuscated malware variants. In this paper, a new malware detection system is proposed based on information retrieval. For the representation of executables, the frequency of the appearance of opcode sequences is used. Through this architecture a malware detection system prototype is developed and evaluated in terms of performance, malware variant recall (false negative ratio) and false positives.

Keywords

MSC

68-00, 68T30, 68U3

Cite this article

@article{cai-111134,
  author  = {Igor Santos and Xabier Ugarte-Pedrero and Felix Brezo and Pablo G. Bringas and Jose Maria Gomez-Hidalgo},
  title   = {NOA: An Information Retrieval Based Malware Detection System},
  journal = {Computing and Informatics},
  volume  = {32},
  number  = {1},
  pages   = {145--174},
  year    = {2013},
  issn    = {1335-9150},
  url     = {https://cai.type.sk/content/2013/1/noa-an-information-retrieval-based-malware-detection-system/}
}
Download .bib