4,213 research outputs found
Detecting Blackholes and Volcanoes in Directed Networks
In this paper, we formulate a novel problem for finding blackhole and volcano
patterns in a large directed graph. Specifically, a blackhole pattern is a
group which is made of a set of nodes in a way such that there are only inlinks
to this group from the rest nodes in the graph. In contrast, a volcano pattern
is a group which only has outlinks to the rest nodes in the graph. Both
patterns can be observed in real world. For instance, in a trading network, a
blackhole pattern may represent a group of traders who are manipulating the
market. In the paper, we first prove that the blackhole mining problem is a
dual problem of finding volcanoes. Therefore, we focus on finding the blackhole
patterns. Along this line, we design two pruning schemes to guide the blackhole
finding process. In the first pruning scheme, we strategically prune the search
space based on a set of pattern-size-independent pruning rules and develop an
iBlackhole algorithm. The second pruning scheme follows a divide-and-conquer
strategy to further exploit the pruning results from the first pruning scheme.
Indeed, a target directed graphs can be divided into several disconnected
subgraphs by the first pruning scheme, and thus the blackhole finding can be
conducted in each disconnected subgraph rather than in a large graph. Based on
these two pruning schemes, we also develop an iBlackhole-DC algorithm. Finally,
experimental results on real-world data show that the iBlackhole-DC algorithm
can be several orders of magnitude faster than the iBlackhole algorithm, which
has a huge computational advantage over a brute-force method.Comment: 18 page
Malware Classification based on Call Graph Clustering
Each day, anti-virus companies receive tens of thousands samples of
potentially harmful executables. Many of the malicious samples are variations
of previously encountered malware, created by their authors to evade
pattern-based detection. Dealing with these large amounts of data requires
robust, automatic detection approaches. This paper studies malware
classification based on call graph clustering. By representing malware samples
as call graphs, it is possible to abstract certain variations away, and enable
the detection of structural similarities between samples. The ability to
cluster similar samples together will make more generic detection techniques
possible, thereby targeting the commonalities of the samples within a cluster.
To compare call graphs mutually, we compute pairwise graph similarity scores
via graph matchings which approximately minimize the graph edit distance. Next,
to facilitate the discovery of similar malware samples, we employ several
clustering algorithms, including k-medoids and DBSCAN. Clustering experiments
are conducted on a collection of real malware samples, and the results are
evaluated against manual classifications provided by human malware analysts.
Experiments show that it is indeed possible to accurately detect malware
families via call graph clustering. We anticipate that in the future, call
graphs can be used to analyse the emergence of new malware families, and
ultimately to automate implementation of generic detection schemes.Comment: This research has been supported by TEKES - the Finnish Funding
Agency for Technology and Innovation as part of its ICT SHOK Future Internet
research programme, grant 40212/0
- …