Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1001370" data-attributes="member: 32260">Your post shows the difference between theory and practice.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />I am not sure if the authors use the term &quot;heuristic&quot; in the same way as you. This term is used by authors only in the context of malware detection made by researchers and it is probably more specific:&quot;A heuristic-based approach has been used in various research by generating generic rules that investigate the extracted data, which are given through dynamic or static analysis to support the proposed model of detecting malicious intent. The generated rules can be developed automatically using machine learning techniques, the YARA tool, and other tools or manually based on the experience and knowledge of expert analysts.&quot;According to this definition, heuristic-based detection is based on static and dynamic data. So, it contains &quot;heuristic signatures&quot;, &quot;heuristic behaviors&quot;, and &quot;heuristic patterns&quot;.Yes. But this is a review of many articles that just did it. The researchers usually must simplify the reality to compare the results with others. This is similar to other disciplines. For example, in medicine, a surgeon can see a human body very differently compared to a psychiatrist.Anyway, the authors agree with you.It must be so because API calls can be seen independently at different stages (analysis, detection, or feature extraction). For example, another set of API calls can be important when analyzing the unknown malware, compared to API calls used for detecting this malware. The same can be true for signature-based and behavior-based detections. In many cases, the malware can be detected first by behavior (API calls used) when there is no malware signature. Some of these API calls can be also used to create malware signatures.This Opcode is taken from the memory when malware is running.</blockquote>

[QUOTE="Andy Ful, post: 1001370, member: 32260"] Your post shows the difference between theory and practice.:) I am not sure if the authors use the term "heuristic" in the same way as you. This term is used by authors only in the context of malware detection made by researchers and it is probably more specific: [I]"A heuristic-based approach has been used in various research by generating generic rules that investigate the extracted data, which are given through dynamic or static analysis to support the proposed model of detecting malicious intent. The generated rules can be developed automatically using machine learning techniques, the YARA tool, and other tools or manually based on the experience and knowledge of expert analysts."[/I] According to this definition, heuristic-based detection is based on static and dynamic data. So, it contains "heuristic signatures", "heuristic behaviors", and "heuristic patterns". Yes. But this is a review of many articles that just did it. The researchers usually must simplify the reality to compare the results with others. This is similar to other disciplines. For example, in medicine, a surgeon can see a human body very differently compared to a psychiatrist. Anyway, the authors agree with you. It must be so because API calls can be seen independently at different stages (analysis, detection, or feature extraction). For example, another set of API calls can be important when analyzing the unknown malware, compared to API calls used for detecting this malware. The same can be true for signature-based and behavior-based detections. In many cases, the malware can be detected first by behavior (API calls used) when there is no malware signature. Some of these API calls can be also used to create malware signatures. This Opcode is taken from the memory when malware is running. [/QUOTE]

Verification