Accurate Adware Detection using Opcode Sequence Extraction

Document type: Conference Papers
Peer reviewed: Yes
Full text:
Author(s): Raja Khurram Shahzad, Niklas Lavesson, Henric Johnson
Title: Accurate Adware Detection using Opcode Sequence Extraction
Conference name: Sixth International Conference on Availability, Reliability and Security
Year: 2011
Pagination: 189-195
ISBN: 978-0-7695-4485-4/11
Publisher: IEEE Press
City: Vienna
URI/DOI: 10.1109/ARES.2011.35
Organization: Blekinge Institute of Technology
Department: School of Computing (Sektionen för datavetenskap och kommunikation)
School of Computing S-371 79 Karlskrona
+46 455 38 50 00
http://www.bth.se/com
Authors e-mail: rks@bth.se, Niklas.Lavesson@bth.se
Language: English
Abstract: Adware represents a possible threat to the security and privacy of computer users. Traditional signature-based and heuristic-based methods have not been proven to be successful at detecting this type of software. This paper presents an adware detection approach based on the application of data mining on disassembled code. The main contributions of the paper is a large publicly available adware data set, an accurate adware detection algorithm, and an extensive empirical evaluation of several candidate machine learning techniques that can be used in conjunction with the algorithm. We have extracted sequences of opcodes from adware and benign software and we have then applied feature selection, using different configurations, to obtain 63 data sets. Six data mining algorithms have been evaluated on these data sets in order to find an efficient and accurate detector. Our experimental results show that the proposed approach can be used to accurately detect both novel and known adware instances even though the binary difference between adware and legitimate software is usually small.
Subject: Computer Science\Artificial Intelligence
Computer Science\Electronic security
Computer Science\General
Keywords: Data Mining, Adware Detection, Binary Classification, Static Analysis, Disassembly, Instruction Sequences
Edit