Interests-Based Spyware Detection

Spyware is a rapidly spreading security issue. Traditional spyware detection can mainly be classified into two categories: signature based detection and behavior based detection. The former is not able to detect unknown spyware and variants of known spyware. The latter fails when spyware attempts to blend in with legitimate behavior. This paper presents a novel spyware detection technique which is based on an abstract characterization of the interests of spyware programs. For sensitive and critical data, we monitor two kinds of actions which are general behaviors for spyware, copy-and-paste and transmission, performed by every program. Then with backward cloud generator we get the interests of every program. If the interests of one program are just the sensitive and critical data, we can tell the program is the spyware program. The experiment verifies the feasibility of our method.