Article citationsMore>>

Rafique, M. Z. and Caballero, J. (2013) Firma: Malware Clustering and Network Signature Generation with Mixed Network Behaviors. RAID 2013 Proceedings of the 16th International Symposium on Research in Attacks, Intrusions, and Defenses, Rodney Bay, St. Lucia, 23-25 October, 8145, 144-163.
https://doi.org/10.1007/978-3-642-41284-4_8

has been cited by the following article:

• TITLE: Exploring the Effects of Gap-Penalties in Sequence-Alignment Approach to Polymorphic Virus Detection

  AUTHORS: Vijay Naidu, Jacqueline Whalley, Ajit Narayanan

  KEYWORDS: Polymorphic Malware Variants, Gap Penalties, Syntactic Approach, Pairwise Sequence Alignment, Multiple Sequence Alignment, Automatic Signature Generation, Smith-Waterman Algorithm, JS. Cassandra Virus, W32.CTX/W32.Cholera Virus, W32.Kitti Virus

  JOURNAL NAME: Journal of Information Security, Vol.8 No.4, October 19, 2017

  ABSTRACT: Antiviral software systems (AVSs) have problems in identifying polymorphic variants of viruses without explicit signatures for such variants. Alignment-based techniques from bioinformatics may provide a novel way to generate signatures from consensuses found in polymorphic variant code. We demonstrate how multiple sequence alignment supplemented with gap penalties leads to viral code signatures that generalize successfully to previously known polymorphic variants of JS. Cassandra virus and previously unknown polymorphic variants of W32.CTX/W32.Cholera and W32.Kitti viruses. The implications are that future smart AVSs may be able to generate effective signatures automatically from actual viral code by varying gap penalties to cover for both known and unknown polymorphic variants.