2002/11/13 by Matthew G. Schultz, Eleazar Eskin, F. Zadok +1 · 1 citation
Computer Science · #Spam and Phishing Detection #Network Security and Intrusion Detection #Advanced Malware Detection Techniques #Executable #Computer science #Heuristics #Set (abstract data type) #Malware #Data mining #Computer security #Operating system
paper · doi:10.1109/secpri.2001.924286
openalex publication_date 2002/11/13 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/02
A serious security threat today is malicious executables, especially new, unseen malicious executables often arriving as email attachments. These new malicious executables are created at the rate of thousands every year and pose a serious security threat. Current anti-virus systems attempt to detect these new malicious programs with heuristics generated by hand. This approach is costly and oftentimes ineffective. We present a data mining framework that detects new, previously unseen malicious executables accurately and automatically. The data mining framework automatically found patterns in our data set and used these patterns to detect a set of new malicious binaries. Comparing our detection methods with a traditional signature-based method, our method more than doubles the current detection rates for new malicious executables.