https://scholars.lib.ntu.edu.tw/handle/123456789/333666
Title: | MAPMon: A Host-Based Malware Detection Tool | Authors: | S. Y. Dai S. Y. Kuo SY-YEN KUO |
Keywords: | Auto-start extensibility point; Backdoor; Honeypot; Malicious software; Malware attacking points | Issue Date: | Dec-2007 | Start page/Pages: | 346-356 | Source: | 2007 Pacific Rim International Symposium on Dependable Computing (PRDC'07) | Abstract: | In order for financial-motivated malware programs such as spyware, virus and worm to survive after system rebooted, they have to modify entries in auto start extensibility points (ASEPs), system calls or system files on a comprised system. We call these system resources which a malware program could attack once it intrudes a host as Malware Attacking Points (MAPs). Based on this observation, we design and implement MAPMon, a monitoring mechanism to detect any suspicious change of Malware Attacking Points. This paper describes the design and implementation trade-off of the MAPMon tool. The effectiveness of the MAPMon tool for malware detection is evaluated by using real-world malware programs including those that do not have signatures. © 2007 IEEE. |
URI: | http://scholars.lib.ntu.edu.tw/handle/123456789/333666 | DOI: | 10.1109/PRDC.2007.47 | SDG/Keyword: | Codes (symbols); Computer crime; Machine design; Maps; Auto-start extensibility point; Backdoor; Dependable computing; Honeypot; Host-based; International symposium; Malicious software; Malware; Malware attacking points; Malware detection; Pacific Rim; Real-world; Spyware; System calls; System files; System resources; Computer worms |
Appears in Collections: | 電機工程學系 |
Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.