Automated Malware Detection Based on Novel Network Behavioral Signatures

In this paper we present the basic principles of the efficient malware detection framework which has higher successful rate in detection of specific zero-day malware that is difficult with common IDPS techniques. We propose a new generation of detection framework based on network behavioral signatures using zero-day exploits, instead of the signaturebased or anomaly-based detection solutions currently available for IDPS technology. Our research aims mainly on detection of attacks that abuse vulnerabilities of buffer overflow type, but the final goal is to extend detection techniques to cover various types of vulnerabilities. This article describes the concept of detection framework, provides a design of model architecture and shows an experimental results with draft of framework on the set of laboratory simulated attacks.