Distinguishing legitimate and fake/crude antivirus software

Masaki Kasuya, Kenji Kono

研究成果: Conference contribution

抄録

Fake antivirus (AV) software, a kind of malware, pretends to be a legitimate AV product and frightens computer users by showing fake security alerts, as if their computers were infected with malware. In addition, fake AV urges users to purchase a "commercial" version of the fake AV. In this paper, we search for an indicator that captures behavioral differences in legitimate AV and fake AV. The key insight behind our approach is that legitimate AV behaves differently in clean and infected environments, whereas fake AV behaves similarly in both environments, because it does not analyze malware in the infected environments. We have investigated three potential indicators, file access pattern, CPU usage, and memory usage, and found that memory usage is an effective indicator to distinguish legitimate AV from fake AV. In an experiment, this indicator identifies all fake AV samples (39 out of 39) as fake and all legitimate AV products (8 out of 8) as legitimate. It is impractical for fake AV to evade this indicator because to do so it would require it to detect malware infections, just as legitimate AV does.

本文言語English
ホスト出版物のタイトルSECURWARE 2013 - 7th International Conference on Emerging Security Information, Systems and Technologies
ページ109-116
ページ数8
出版ステータスPublished - 2013 12 1
イベント7th International Conference on Emerging Security Information, Systems and Technologies, SECURWARE 2013 - Barcelona, Spain
継続期間: 2013 8 252013 8 31

出版物シリーズ

名前SECURWARE 2013 - 7th International Conference on Emerging Security Information, Systems and Technologies

Other

Other7th International Conference on Emerging Security Information, Systems and Technologies, SECURWARE 2013
国/地域Spain
CityBarcelona
Period13/8/2513/8/31

ASJC Scopus subject areas

  • 情報システム

フィンガープリント

「Distinguishing legitimate and fake/crude antivirus software」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル