Abstract
A hybrid algorithm based on attribute reduction of Rough Sets(RS) and classification principles of Support Vector Machine (SVM) to detect new malicious executable codes is present. Firstly, the attribute reduction of RS has been applied as preprocessor so that we can delete redundant attributes and conflicting objects from decision making table but remain efficient information lossless. Then, we realize classification modeling and forecasting test based on SVM. By this method, we can reduce the dimension of data, decrease the complexity in the process. Finally, comparison of detection ability between the above detection method and others is given. Experiment result shows that the present method could effectively use to discriminate normal and abnormal executable codes.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Wildlist Organization Home Page: http://www.wildlist.org
Lo, R., Levitt, K., Olsson, R.: MCF: A Malicious Code Filter. Computers and Security 14, 541–566 (1995)
Tesauro, G., Kephart, J., Sorkin, G.: Neural networks for computer virus recognition. IEEE Expert 8, 5–6 (1996)
Schultz, M., Eskin, E., Zadok, E., Stolfo, S.: Data mining methods for detection of new malicious executables. In: Proceedings of the 2001 IEEE Symposium on Security and Privacy, Los Alamitos, pp. 38–49 (2001)
Vmware: http://www.vmware.com
Pawlak, Z.: Rough sets theoretical aspests of reasoning about data. Kluwer academic publishers, Boston (1991)
Zhang, B., Yin, Y., Hao, J.: J.: Using Fuzzy Pattern Recognition to Detect Unknown Ma-licious Executables Code. In: Proceedings of the Second International Conference on Fuzzy Systems and Knowledge Discovery, Changsha, pp. 629–634 (2005)
Zhang, B.Y., Yin, J., Zhang, D., Hao, j.: Unknown Computer Virus Detection Based on K-Nearest Neighbor Algorithm. Computer Engineering and Aplications 6, 7–10 (2005)
Rewat, S., Gulati, V.P., Pujari, A.K.: A Fast Host-based IntrusionDetection Using Rough Set Theory. In: Peters, J.F., Skowron, A. (eds.) Transactions on Rough Sets IV. LNCS, vol. 3700, pp. 144–162. Springer, Heidelberg (2005)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2006 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Zhang, B., Yin, J., Hao, J. (2006). Using RS and SVM to Detect New Malicious Executable Codes. In: Wang, GY., Peters, J.F., Skowron, A., Yao, Y. (eds) Rough Sets and Knowledge Technology. RSKT 2006. Lecture Notes in Computer Science(), vol 4062. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11795131_83
Download citation
DOI: https://doi.org/10.1007/11795131_83
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-36297-5
Online ISBN: 978-3-540-36299-9
eBook Packages: Computer ScienceComputer Science (R0)