IMAD: in-execution malware analysis and detection

The sophistication of computer malware is becoming a serious threat to the information technology infrastructure, which is the backbone of modern e-commerce systems. We, therefore, advocate the need for developing sophisticated, efficient, and accurate malware classification techniques that can detect a malware on the first day of its launch – commonly known as “zero-day malware detection”. To this end, we present a new technique, IMAD, that can not only identify zero-day malware without any apriori knowledge but can also detect a malicious process while it is executing (inexecution detection). The capability of in-execution malware detection empowers an operating system to immediately kill it before it can cause any significant damage. IMAD is a realtime, dynamic, efficient, in-execution zero-day malware detection scheme, which analyzes the system call sequence of a process to classify it as malicious or benign. We use Genetic Algorithm to optimize system parameters of our ...

• Type: Conference
• Year: 2009
• Where: GECCO
• Authors: Syed Bilal Mehdi, Ajay Kumar Tanwani, Muddassar Farooq
• Keywords: Artificial Intelligence, GECCO 2009, Malware, Malware Detection, Zero-day Malware