Kent E. Griffin | Researchain

Archive Network Publication Hotspot Collaboration

Hotspot

Bubble
[Coming Soon]

Cloud

Mosaic
[Coming Soon]

recent advances in intrusion detection | 2009

Automatic Generation of String Signatures for Malware Detection

Kent E. Griffin; Scott Schneider; Xin Hu; Tzi-cker Chiueh

Scanning files for signatures is a proven technology, but exponential growth in unique malware programs has caused an explosion in signature database sizes. One solution to this problem is to use string signatures , each of which is a contiguous byte sequence that potentially can match many variants of a malware family. However, it is not clear how to automatically generate these string signatures with a sufficiently low false positive rate. Hancock is the first string signature generation system that takes on this challenge on a large scale. To minimize the false positive rate, Hancock features a scalable model that estimates the occurrence probability of arbitrary byte sequences in goodware programs, a set of library code identification techniques, and diversity-based heuristics that ensure the contexts in which a signature is embedded in containing malware files are similar to one another. With these techniques combined, Hancock is able to automatically generate string signatures with a false positive rate below 0.1%.

Archive | 2006

Hygiene based computer security

Carey Nachenberg; Kent E. Griffin

Archive | 2008

Modeling goodware characteristics to reduce false positive malware signatures

Scott Schneider; Kent E. Griffin

Archive | 2008

Reducing malware signature set size through server-side processing

Carey Nachenberg; Kent E. Griffin

usenix annual technical conference | 2013

MutantX-S: scalable malware clustering based on static features

Xin Hu; Sandeep Bhatkar; Kent E. Griffin; Kang G. Shin

Archive | 2008

Reputation based identification of false positive malware detections

Carey Nachenberg; Kent E. Griffin

Archive | 2007

Load balancing using a distributed hash

Darren M. Sanders; Carey Nachenberg; Kent E. Griffin

Archive | 2008

Selecting malware signatures to reduce false-positive detections

Kent E. Griffin; Tzi-cker Chiueh; Scott Schneider; Xin Hu

Archive | 2009

Systems and methods for byte-level context diversity-based automatic malware signature generation

Kent E. Griffin; Tzi-cker Chiueh; Scott Schneider

Archive | 2009

Selecting malware signatures based on malware diversity

Tzi-cker Chiueh; Kent E. Griffin; Scott Schneider; Xin Hu

Explore More