Browsing by Author "Lee, Chia-Yin"

Now showing 1 - 3 of 3

Active versus Passive Malware Collection
(2014-04-01)
Lin, Ying-Dar
;
Lee, Chia-Yin
;
Wu, Yu-Sung
;
Ho, Pei-Hsiu
;
Wang, Fu-Yu
An exploration of active and passive malware honeypots reveals that the two systems yield vastly different malware collections and that peer-to-peer file sharing is an important, but often overlooked, malware source.
Redefining Security Criteria for Networking Devices with Case Studies
(2014-01-01)
Lin, Ying-Dar
;
Lee, Chia-Yin
;
Tsai, Hao-Chuan
;
資訊工程學系
;
Department of Computer Science
Common Criteria, ICSA Labs, and NSS Labs-three well-known standard security criteria-combine with the RealFlow stability test to form a set of lightweight total security criteria, providing wide coverage on documentation, security functionality, performance, self-protection, and stability in a short evaluation period.
Three-phase behavior-based detection and classification of known and unknown malware
(2015-07-25)
Lin, Ying-Dar
;
Lai, Yuan-Cheng
;
Lu, Chun-Nan
;
Hsu, Peng-Kai
;
Lee, Chia-Yin
To improve both accuracy and efficiency in detecting known and even unknown malware, we propose a three-phase behavior-based malware detection and classification approach, with a faster detector in the first phase to filter most samples, a slower detector in the second phase to observe remaining ambiguous samples, and then a classifier in the third phase to recognize their malware type. The faster detector executes programs in a sandbox to extract representative behaviors fed into a trained artificial neural network to evaluate their maliciousness, whereas the slower detector extracts and matches the LCSs of system call sequences fed into a trained Bayesian model to calculate their maliciousness. In the third phase, we define malware behavior vectors and calculate the cosine similarity to classify the malware. The experimental results show that the hybrid two-phase detection scheme outperforms the one-phase schemes and achieves 3.6% in false negative and 6.8% in false positive. The third-phase classifier also distinguishes the known-type malware with an accuracy of 85.8%. Copyright (c) 2015 John Wiley & Sons, Ltd.