title: The effects of different representations on static structure analysis of computer malware signatures.
abstract: The continuous growth of malware presents a problem for internet computing due to increasingly sophisticated techniques for disguising malicious code through mutation and the time required to identify signatures for use by antiviral software systems (AVS). Malware modelling has focused primarily on semantics due to the intended actions and behaviours of viral and worm code. The aim of this paper is to evaluate a static structure approach to malware modelling using the growing malware signature databases now available. We show that, if malware signatures are represented as artificial protein sequences, it is possible to apply standard sequence alignment techniques in bioinformatics to improve accuracy of distinguishing between worm and virus signatures. Moreover, aligned signature sequences can be mined through traditional data mining techniques to extract metasignatures that help to distinguish between viral and worm signatures. All bioinformatics and data mining analysis were performed on publicly available tools and Weka.
authors: School of Computing and Mathematical Sciences, Auckland University of Technology, Auckland 1010, New Zealand.
authors: Ajit
authors: A
authors: Narayanan
authors: Yi
authors: Y
authors: Chen
authors: Shaoning
authors: S
authors: Pang
authors: Ban
authors: B
authors: Tao
mesh_terms: D000595:Amino Acid Sequence; D016494:Computer Security; D003628:Database Management Systems; D008962:Models, Theoretical; D008969:Molecular Sequence Data; D011487:Protein Conformation; D011506:Proteins / Q000737:chemistry
chemical_list: D011506:Proteins
references: Bioinformatics. 2007 Nov 1;23(21):2947-8
references: 17846036
references: J Mol Biol. 1970 Mar;48(3):443-53
references: 5420325
references: J Mol Biol. 1981 Mar 25;147(1):195-7
references: 7265238