Visualizing windows executable viruses using self-organizing maps

This paper concentrates on visualizing computer viruses without using virus specific signature information as a prior stage of the very important problem of detecting computer viruses. In this paper, we address the fact that each viruses have its own character to be distinguished although it is inserted in the executable file. They cannot hide their own feature through the SOM visualization; this feature is like a DNA to determine an individual’s unique genetic code. We present how virus codes affect the whole program projection. Without each virus signature, we present how the virus pattern in Windows executable files tells us their family. We show that the variant of each virus also can be covered with each virus mask, which is produced by SOM. We also present the file structure based SOMs of Windows executable files. Categories and Subject Descriptors K.6.5 [Management of Computing and Information Systems]: Security and Protection—Invasive software; I.2.6 [Artificial Int...

• Type: Conference
• Year: 2004
• Where: VIZSEC
• Authors: InSeon Yoo
• Keywords: Executable files, Virus, VIZSEC 2004, Windows Executable files