Combining file content and file relations for cloud based malware detection

摘要: Due to their damages Internet security, malware (such as virus, worms, trojans, spyware, backdoors, and rootkits) detection has caught the attention not only of anti-malware industry but also researchers for decades. Resting on analysis file contents extracted from samples, like Application Programming Interface (API) calls, instruction sequences, binary strings, data mining methods such Naive Bayes Support Vector Machines have been used detection. However, besides contents, relations among a "Downloader" is always associated with many Trojans, can provide invaluable information about properties samples. In this paper, we study how be improve results develop verdict system (named "Valkyrie") building semi-parametric classifier model combine content together To best our knowledge, first work using both A comprehensive experimental large collection PE files obtained clients products Comodo Security Solutions Incorporation performed compare various approaches. Promising demonstrate that accuracy efficiency Valkyrie outperform other popular software tools Kaspersky AntiVirus McAfee VirusScan, well alternative based systems.