Learning to Detect New and Unknown Malicious Programs

As you may have guessed by now, the automated discovery of new threats for rapid response is one of my favorite topics. This paper is up that alley:

Malicious programs pose a major threat to security, especially in the Windows platform. The most dangerous of these malicious programs are the ones that are new or unknown because they are not detected by traditional signature based anti-virii software. In this paper we present a data-mining approach to detecting new and unknown malicious programs. We extract a set of features from these programs through static analysis and build a classifier that detects which programs are potentially malicious. This classifier can generalize to other new or other unknown programs. We verify our results by testing our methods on a set of programs not used during training (i.e., programs unknown to our classifier). In one experiment, our method detects 81.54% of previously unknown malicious programs with a 0.96% false-positive rate.

Source: Learning to Detect New and Unknown Malicious Programs, Eleazar Eskin, Matthew G. Schultz, Erez Zadok, and Salvatore J. Stolfo.