6th European Conference - Academic Conferences

Trojan.Sp
y.Zeus.1.
Gen.mal
Trojan.Zb
ot-
1307.mal
Trojan.Zb
ot-
2163.mal
Tro
jan.
Sp
y.Z
eus
.1.
Ge
n.
mal
54.
23
57.
10
63.
53
Troj
an.Z
bot-
85.
mal
Madhu Shankarapani and Srinivas Mukkamala
Troja
n.Spy
.Zeus
.2.Ge
n.mal
63.8
2 78.15
58.4
6 63.92
56.5
1 81.88
Troj
an.B
roke
r-
12.
mal
61.3
3
78.4
7
84.0
4
5. Similarity analysis results
Troj
an.
Zbo
t-
134
2.m
al
86.
42
82.
03
74.
65
Troj
an.
Spy
.Ze
us.
1.G
en.
mal
66.
27
60.
21
55.
75
Troj
an.S
py.Z
eus.
1.Ge
n.m
al
59.4
5
59.6
4
68.0
1
Troj
an.S
py.Z
eus.
1.Ge
n.m
al
Troja
n.Zbo
t-
290.
mal
Troja
n.Spy
.Zeus
.1.Ge
n.mal
66.6
9 76.85 58.62
54.5
9 64.83 64.50
60.6
6 50.08 60.47
We apply the traditional similarity functions on Vs’ and Vu’. Cosine measure, extended Jaccard
measure, and the Pearson correlation measure are the popular measures of similarity for sequences.
The cosine measure is given below and captures a scale-invariant understanding of similarity.
Cosine similarity: Cosine similarity is a measure of similarity between two vectors of n dimensions
by finding the angle between them.
Extended Jaccard measure: The extended Jaccard coefficient measures the degree of overlap
between two sets and is computed as the ratio of the number of shared attributes ofVs’ AND Vu’to the
number possessed byVs’ORVu’.
Pearson correlation: Correlation gives the linear relationship between two variables. For a series of
n measurements of variablesVs’andVu’, Pearson correlation is given by the formula below.
Where and are values of variable Vs’ and Vu’ respectively at position i, n is the number of
measurements, and are standard deviations of Vs’ and Vu’ respectively and and are
means of Vs’ and Vu’ respectively.
In these experiments, we calculated the mean value of the three measures. For a particular measure
between a virus signature and a suspicious binary file, S(m)(Vs’i, Vu’), which stands for the similarity
between virus signature i and a suspicious binary file. Our similarity report is generated by calculating
the S(m)(Vs’i, Vu’) value for each virus signature in the signature database.
In this experiment, we compared Zeus/Zbot variants against itself, creating n-by-n matrix which shows
how similar are the variants. Table 1 shows the similarity values of Zeus/Zbot compared among
themselves. From the Table 1 we can infer that variants of Zeus/Zbot are almost similar to sequence
in which the Windows APIs are called.
6. Conclusion
In this paper, we present our effort of approach on malware detection based on Windows API call
sequence. According to our observations, though there is tremendous increase in Zeus/Zbot variant
builders, its behavior of API calls remains almost the same. Thus our approach can detect its variants
258
Troj
an.Z
bot-
115
1.m
al
74.0
3
73.5
8
78.3
0
DHL
_DO
C.m
al
(3)
80.9
5
64.2
9
50.7
3
(1)
(2)
Troj
an.
Spy.
Zeu
s.1.
Gen
.mal
87.5
1
54.3
4
56.1
0