ENDMal: An anti-obfuscation and collaborative malware detection system using syscall sequences

摘要: Abstract Malware obfuscation obscures malware into different versions, making traditional syntactic nature based detection ineffective. Furthermore, with the huge and exponentially growing number of samples, existing systems are either evaded by obfuscation, or overwhelmed numerous samples. This paper proposes an anti-obfuscation, scalable collaborative system—ENDMal. ENDMal identifies program that behaves suspiciously in end-hosts similarly between a group suspicious programs wide area as malicious. We present Iterative Sequence Alignment (ISA) method to defeat obfuscation. Instead using complex behavior graph, we propose Handle dependences Probabilistic Ordering Dependence (HPOD) technology represent behaviors. In addition, design novel information sharing infrastructure, RENShare, collaboratively congregate characteristics spreading over network areas. Our experimental results show can detect unknown malwares much faster than centralized system is more effective distributed system.