Search

The continuous growth of malware presents a problem for internet computing due to increasingly sophisticated techniques for disguising malicious code through mutation and the time required to identify signatures for use by antiviral software systems (AVS). Malware modelling has focused primarily on semantics due to the intended actions and behaviours of viral and worm code. The aim of this paper is to evaluate a static structure approach to malware modelling using the growing malware signature databases now available. We show that, if malware signatures are represented as artificial protein sequences, it is possible to apply standard sequence alignment techniques in bioinformatics to improve accuracy of distinguishing between worm and virus signatures. Moreover, aligned signature sequences can be mined through traditional data mining techniques to extract metasignatures that help to distinguish between viral and worm signatures. All bioinformatics and data mining analysis were performed on publicly available tools and Weka.

Sequence alignment is widely used in bioinformatics for revealing the genetic diversity of organisms and annotating gene functions by finding regions of similarity across biosequences. Such alignment requires sequences to be represented in the DNA or protein alphabet for tools such as Clustal to work. Previous work has demonstrated the feasibility of applying biosequence multiple alignment techniques to computer viral and worm signatures to find regions of similarity that can serve as malware i®motifs', or meta-signatures. However, it was not known how different ways of representing signatures in an appropriate biosequence alphabet would affect the alignment results. This paper investigates the effects of adopting three different ways of representing malware signatures on sequence alignment and motif identification. The results of the alignment were checked with perceptrons, decision tree and logistic regression. The best performing representation was used to derive rules in PRISM that give rise to i®motifs' that can perform the role of i®meta-signatures'. All analysis was undertaken on the publicly available data mining tool, Weka (Waikato Environment for Knowledge Analysis: http://www.cs.waikato.ac.nz/ml/weka/).

Malware is currently a major threat to information and computer security, with the volume and growing diversity of its variants causing major problems to traditional security defenses. Software patches and upgrades to anti-viral packages are typically released only after the malware's key characteristics have been identified through infection, by which time it may be too late to protect systems. Sequence analysis is widely used in bioinformatics for revealing the genetic diversity of organisms and annotating gene functions. This paper adopts a new approach to the problem of malware recognition, which is to use multiple sequence alignment techniques from bioinformatics to align variable length computer viral and worm code so that core, invariant regions of the code occupy fixed positions in the alignment patterns. Data mining (ANNs, symbolic rule extraction) can then be used to learn the critical features that help to determine into which class the aligned patterns fall. Experimental results demonstrate the feasibility of our novel approach for identifying malware code through multiple sequence alignment followed by analysis by ANNs and symbolic rule extraction methods.