Targeting malware discrimination based on reversed association task. (19th September 2018)

• Record Type: Journal Article
• Authors: Han, Lansheng; Zhou, Man; Han, Shuxia; Jia, Wenjing; Sun, Changhua; Fu, Cai
• Other Names: Chen Jinjun guestEditor.; Zheng Xianghan guestEditor.; Rong Chunming guestEditor.; Badarch Tuyatsetseg guestEditor.; Nanda Priyadarsi guestEditor.; Puthal Deepak guestEditor.; Mohanty Saraju P. guestEditor.
• Is Part Of: Concurrency and computation. Volume 31:Number 23(2019)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2018-09-19
• Subjects: computable -- decidable -- malware discrimination -- reduction theory -- reversed task -- targeting malware; Parallel processing (Electronic computers) -- Periodicals; Parallel computers -- Periodicals; 004.35
• DOI: 10.1002/cpe.4922
• Languages: English
• ISSNs: 1532-0626

Abstract

Summary: Regarding the current situation that the recognition rate of malware is decreasing, the article points out that the reason for this dilemma is that more and more targeting malware have emerged, which share little or no common feature with traditional malware. The premise of malware recognition judging whether a software is malicious or benign is actually a decision problem. We propose that malware discrimination should resort to the corresponding task or purpose. We first present a formal definition of a task and then provide further classifications of malicious tasks. Based on the decidable theory, we prove that task performed by any software is recursive and determinable. By establishing a mapping from software to task, we prove that software is many‐to‐one reducible to corresponding tasks. Thus, we demonstrate that software, including malware, is also recursive and can be determined by the corresponding tasks. Finally, we present the discrimination process of our method. Nine real malwares are presented, which were firstly discriminated by our method but at that time could not be identified by Kaspersky, McAfee, Symantec Norton, or Kingsoft Antivirus.