Digital Commons Network^™

Classifying Malicious Windows Executables Using Anomaly Based Detection, Ronak Sutaria

Theses

A malicious executable is broadly defined as any program or piece of code designed to cause damage to a system or the information it contains, or to prevent the system from being used in a normal manner. A generic term used to describe any kind of malicious software is Maiware, which includes Viruses, Worms, Trojans, Backdoors, Root-kits, Spyware and Exploits. Anomaly detection is technique which builds a statistical profile of the normal and malicious data and classifies unseen data based on these two profiles.

A detection system is presented here which is anomaly based and focuses on the Windows® platform. …