Data Mining Methods for Detection of New Malicious Executables

Matthew G. Schultz and Eleazar Eskin
Department of Computer Science
Columbia University
{mgs,eeskin}@cs.columbia.edu - Erez Zadok
Department of Computer Science
State University of New York at Stony Brook
ezk AT cs.sunysb.edu - Salvatore J. Stolfo
Department of Computer Science
Columbia University
sal@cs.columbia.edu

Abstract:

A serious security threat today is malicious executables, especially new, unseen malicious executables often arriving as email attachments. These new malicious executables are created at the rate of thousands every year and pose a serious security threat. Current anti-virus systems attempt to detect these new malicious programs with heuristics generated by hand. This approach is costly and oftentimes ineffective. In this paper, we present a data-mining framework that detects new, previously unseen malicious executables accurately and automatically. The data-mining framework automatically found patterns in our data set and used these patterns to detect a set of new malicious binaries. Comparing our detection methods with a traditional signature-based method, our method more than doubles the current detection rates for new malicious executables.