AutoMal: automatic clustering and signature generation for malwares based on the network flow. Issue 10 (29th May 2014)

• Record Type: Journal Article
• Authors: Hao, Sun; Wang, Wen; Lu, Huabiao; Ren, Peige; Su, Jinshu; Wang, Xiaofeng; Shi, Weisong; Ray, Indrakshi
• Is Part Of: Security and communication networks. Volume 8:Issue 10(2015)
• Page Start: 1845
• Page End: 1854
• Publication Date: 2014-05-29
• Subjects: Computer networks -- Security measures -- Periodicals; Computer security -- Periodicals; Cryptography -- Periodicals; 005.805
• DOI: 10.1002/sec.1029
• Languages: English
• ISSNs: 1939-0114

Abstract

<abstract abstract-type="main"> <title>Abstract</title> <p>The volume of malwares is growing at an exponential speed nowadays. This huge growth makes it extremely hard to analyse malware manually. Most existing signatures extracting methods are based on string signatures, and string matching is not accurate and time consuming. Therefore, this paper presents AutoMal, a system for automatically extracting signatures from large‐scale malwares. Firstly, the system proposes to represent the network flows by using feature hashing, which can dramatically reduce the high‐dimensional feature spaces that are general in malware analysis. Then, we design a clustering and median filtering method to classify the malware vectors into different types. Finally, it introduces the signature generation algorithm based on Bayesian method. The system can extract both the byte signature and the hash signature of malwares from its network flow with low false positive and zero false negative. Our evaluation shows that AutoMal can generate strongly noise‐resisted signatures that exactly depict the characteristics of malware. Copyright © 2014 John Wiley &amp; Sons, Ltd.</p> </abstract>