Instruct: Identify the main and secondary category of Arxiv papers based on the titles and abstracts
Query: Virtual Machine Introspection Based Malware Behavior Profiling and
  Family Grouping   The proliferation of malwares have been attributed to the alternations of a
handful of original malware source codes. The malwares alternated from the same
origin share some intrinsic behaviors and form a malware family. Expediently,
identifying its malware family when a malware is first seen on the Internet can
provide useful clues to mitigate the threat. In this paper, a malware profiler
(VMP) is proposed to profile the execution behaviors of a malware by leveraging
virtual machine introspection (VMI) technique. The VMP inserts plug-ins inside
the virtual machine monitor (VMM) to record the invoked API calls with their
input parameters and return values as the profile of malware. In this paper, a
popular similarity measurement Jaccard distance and a phylogenetic tree
construction method are adopted to discover malware families. The studies of
malware profiles show the malwares from a malware family are very similar to
each others and distinct from other malware families as well as benign
software. This paper also examines VMP against existing anti-malware detection
engines and some well-known malware grouping methods to compare the goodness in
their malware family constructions. A peer voting approach is proposed and the
results show VMP is better than almost all of the compared anti-malware
engines, and compatible with the fine tuned text-mining approach and high order
N-gram approaches. We also establish a malware profiling website based on VMP
for malware research.

35
The categories of this paper are: mtrl-th
29
The categories of this paper are: funct-an
6
The categories of this paper are: astro-ph
31
The categories of this paper are: ao-sci
27
The categories of this paper are: comp-gas
37
The categories of this paper are: supr-con
15
The categories of this paper are: nucl-ex
24
The categories of this paper are: dg-ga
9
The categories of this paper are: nlin
23
The categories of this paper are: solv-int
3
The categories of this paper are: physics
11
The categories of this paper are: hep-lat
26
The categories of this paper are: bayes-an
2
The categories of this paper are: math
33
The categories of this paper are: plasm-ph
20
The categories of this paper are: acc-phys