S. Y. DaiSY-YEN KUO2018-09-102018-09-102007-12http://scholars.lib.ntu.edu.tw/handle/123456789/333666In order for financial-motivated malware programs such as spyware, virus and worm to survive after system rebooted, they have to modify entries in auto start extensibility points (ASEPs), system calls or system files on a comprised system. We call these system resources which a malware program could attack once it intrudes a host as Malware Attacking Points (MAPs). Based on this observation, we design and implement MAPMon, a monitoring mechanism to detect any suspicious change of Malware Attacking Points. This paper describes the design and implementation trade-off of the MAPMon tool. The effectiveness of the MAPMon tool for malware detection is evaluated by using real-world malware programs including those that do not have signatures. © 2007 IEEE.Auto-start extensibility point; Backdoor; Honeypot; Malicious software; Malware attacking points[SDGs]SDG16Codes (symbols); Computer crime; Machine design; Maps; Auto-start extensibility point; Backdoor; Dependable computing; Honeypot; Host-based; International symposium; Malicious software; Malware; Malware attacking points; Malware detection; Pacific Rim; Real-world; Spyware; System calls; System files; System resources; Computer wormsconference paper10.1109/PRDC.2007.472-s2.0-50049126427