A system call analysis method with MapReduce for malware detection

Shun Te Liu, Hui Ching Huang, Yi Ming Chen

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

13 Scopus citations

Abstract

System calls have long been used to profile a program as a malware. As previous system call based malware detection approaches are often process-oriented, which determines a process as a malware only by its invoking system calls, they often miss the module-based malware such as DLL-based malware and the co-working malware that splits itself into several programs and co-works to complete their functions. To deal with this problem, the system calls should be collected and analyzed as richly as before. However, analyzing rich system calls will cause a significant performance impact on the clients. Fortunately, with the evolution of distributable computing techniques such as MapReduce, we can overcome this tradeoff by analyzing the system calls for malware detection on the servers and then reduce the performance impact on the clients. In this paper, we revise the previous malware persistent model to cover the module-based and co-working malware. We also propose a MapReduce-based system call analysis method to realize the new model. This method is implemented on a Hadoop platform and uses 50 readworld malware for effective and efficient tests. The experimental results show that the detection rate can improve by 28% and performance can improve by more than 30% in comparison to previous research.

Original languageEnglish
Title of host publicationProceedings - 2011 17th IEEE International Conference on Parallel and Distributed Systems, ICPADS 2011
Pages631-637
Number of pages7
DOIs
StatePublished - 2011
Event2011 17th IEEE International Conference on Parallel and Distributed Systems, ICPADS 2011 - Tainan, Taiwan
Duration: 7 Dec 20119 Dec 2011

Publication series

NameProceedings of the International Conference on Parallel and Distributed Systems - ICPADS
ISSN (Print)1521-9097

Conference

Conference2011 17th IEEE International Conference on Parallel and Distributed Systems, ICPADS 2011
Country/TerritoryTaiwan
CityTainan
Period7/12/119/12/11

Keywords

  • Behavior-based
  • Malware detection
  • MapReduce
  • System calls

Fingerprint

Dive into the research topics of 'A system call analysis method with MapReduce for malware detection'. Together they form a unique fingerprint.

Cite this