MAPMon: A Host-Based Malware Detection Tool
Journal
2007 Pacific Rim International Symposium on Dependable Computing (PRDC'07)
Pages
346-356
Date Issued
2007-12
Author(s)
S. Y. Dai
Abstract
In order for financial-motivated malware programs such as spyware, virus and worm to survive after system rebooted, they have to modify entries in auto start extensibility points (ASEPs), system calls or system files on a comprised system. We call these system resources which a malware program could attack once it intrudes a host as Malware Attacking Points (MAPs). Based on this observation, we design and implement MAPMon, a monitoring mechanism to detect any suspicious change of Malware Attacking Points. This paper describes the design and implementation trade-off of the MAPMon tool. The effectiveness of the MAPMon tool for malware detection is evaluated by using real-world malware programs including those that do not have signatures. © 2007 IEEE.
Subjects
Auto-start extensibility point; Backdoor; Honeypot; Malicious software; Malware attacking points
SDGs
Other Subjects
Codes (symbols); Computer crime; Machine design; Maps; Auto-start extensibility point; Backdoor; Dependable computing; Honeypot; Host-based; International symposium; Malicious software; Malware; Malware attacking points; Malware detection; Pacific Rim; Real-world; Spyware; System calls; System files; System resources; Computer worms
Type
conference paper