On the study of one way to detect anomalous program execution
Developing more accurate and adaptive methods for detecting malicious code is a critical challenge in the context of constantly evolving cybersecurity threats. This requires constant attention to new vulnerabilities and attack methods, as well as the search for innovative approaches to detecting and...
Saved in:
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Yaroslavl State University
2024-06-01
|
| Series: | Моделирование и анализ информационных систем |
| Subjects: | |
| Online Access: | https://www.mais-journal.ru/jour/article/view/1851 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1849338691209658368 |
|---|---|
| author | Yury V. Kosolapov Tatjyana A. Pavlova |
| author_facet | Yury V. Kosolapov Tatjyana A. Pavlova |
| author_sort | Yury V. Kosolapov |
| collection | DOAJ |
| description | Developing more accurate and adaptive methods for detecting malicious code is a critical challenge in the context of constantly evolving cybersecurity threats. This requires constant attention to new vulnerabilities and attack methods, as well as the search for innovative approaches to detecting and preventing cyber threats. The paper examines an algorithm for detecting the execution of malicious code in the process of a protected program. This algorithm is based on a previously proposed approach, when the legitimate execution of a protected program is described by a profile of differences in the return addresses of called functions, also called a distance profile. A concept has been introduced called positional distance, which is determined by the difference between the call numbers in the program trace. The main change was the ability to add to the profile the distances between the return addresses of not only neighboring functions, but also several previous ones with a given positional distance. In addition to modifying the detection algorithm, the work developed a tool for automating the construction of a distance profile and experimentally studied the dependence of the probability of false detection of an atypical distance on the training duration for four well-known browsers. Experiments confirm that with a slight increase in verification time, the number of atypical distances detected by the proposed algorithm can be significantly less than the number of atypical distances detected by the basic algorithm. However, it should be noted that the effect of the transition from the basic algorithm to the proposed one, as the results showed, depends on the characteristics of the specific program being protected. The study highlights the importance of continually improving malware detection techniques to adapt them to changing threats and software operating conditions. As a result, this will ensure more reliable protection of information and systems from cyber attacks and other cyber threats. |
| format | Article |
| id | doaj-art-2b381bf9252d4bd7a5f9be43f0f5a18c |
| institution | Kabale University |
| issn | 1818-1015 2313-5417 |
| language | English |
| publishDate | 2024-06-01 |
| publisher | Yaroslavl State University |
| record_format | Article |
| series | Моделирование и анализ информационных систем |
| spelling | doaj-art-2b381bf9252d4bd7a5f9be43f0f5a18c2025-08-20T03:44:19ZengYaroslavl State UniversityМоделирование и анализ информационных систем1818-10152313-54172024-06-0131215216310.18255/1818-1015-2024-2-152-1631408On the study of one way to detect anomalous program executionYury V. Kosolapov0Tatjyana A. Pavlova1Southern Federal UniversitySouthern Federal UniversityDeveloping more accurate and adaptive methods for detecting malicious code is a critical challenge in the context of constantly evolving cybersecurity threats. This requires constant attention to new vulnerabilities and attack methods, as well as the search for innovative approaches to detecting and preventing cyber threats. The paper examines an algorithm for detecting the execution of malicious code in the process of a protected program. This algorithm is based on a previously proposed approach, when the legitimate execution of a protected program is described by a profile of differences in the return addresses of called functions, also called a distance profile. A concept has been introduced called positional distance, which is determined by the difference between the call numbers in the program trace. The main change was the ability to add to the profile the distances between the return addresses of not only neighboring functions, but also several previous ones with a given positional distance. In addition to modifying the detection algorithm, the work developed a tool for automating the construction of a distance profile and experimentally studied the dependence of the probability of false detection of an atypical distance on the training duration for four well-known browsers. Experiments confirm that with a slight increase in verification time, the number of atypical distances detected by the proposed algorithm can be significantly less than the number of atypical distances detected by the basic algorithm. However, it should be noted that the effect of the transition from the basic algorithm to the proposed one, as the results showed, depends on the characteristics of the specific program being protected. The study highlights the importance of continually improving malware detection techniques to adapt them to changing threats and software operating conditions. As a result, this will ensure more reliable protection of information and systems from cyber attacks and other cyber threats.https://www.mais-journal.ru/jour/article/view/1851exploitsprogram protectionabnormal program execution |
| spellingShingle | Yury V. Kosolapov Tatjyana A. Pavlova On the study of one way to detect anomalous program execution Моделирование и анализ информационных систем exploits program protection abnormal program execution |
| title | On the study of one way to detect anomalous program execution |
| title_full | On the study of one way to detect anomalous program execution |
| title_fullStr | On the study of one way to detect anomalous program execution |
| title_full_unstemmed | On the study of one way to detect anomalous program execution |
| title_short | On the study of one way to detect anomalous program execution |
| title_sort | on the study of one way to detect anomalous program execution |
| topic | exploits program protection abnormal program execution |
| url | https://www.mais-journal.ru/jour/article/view/1851 |
| work_keys_str_mv | AT yuryvkosolapov onthestudyofonewaytodetectanomalousprogramexecution AT tatjyanaapavlova onthestudyofonewaytodetectanomalousprogramexecution |