Sciweavers

Share
PR
2008

Probabilistic suffix models for API sequence analysis of Windows XP applications

9 years 7 months ago
Probabilistic suffix models for API sequence analysis of Windows XP applications
Given the pervasive nature of malicious mobile code (viruses, worms, etc.), developing statistical/structural models of code execution is of considerable importance. We investigate using probabilistic suffix trees (PSTs) and associated suffix automata (PSAs) to build models of benign application behavior with the goal of subsequently being able to detect malicious applications as anything that deviates therefrom. We describe these probabilistic suffix models and present new generic analysis and manipulation algorithms. The models and the algorithms are then used in the context of API (i.e., system call) sequences realized by Windows XP applications. The analysis algorithms, when applied to traces (i.e., sequences of API calls) of benign and malicious applications, aid in choosing an appropriate modeling strategy in terms of distance metrics and consequently provide classification measures in terms of sequence-to-model matching. We give experimental results based on classification of u...
Geoffrey Mazeroff, Jens Gregor, Michael G. Thomaso
Added 14 Dec 2010
Updated 14 Dec 2010
Type Journal
Year 2008
Where PR
Authors Geoffrey Mazeroff, Jens Gregor, Michael G. Thomason, Richard Ford
Comments (0)
books