¹The 28^th Research Institute of China Electronics Technology Group Corporation, Nanjing 210007, China
²Computer School, Wuhan University, Wuhan 430079, China

---

Abstract—Evasive software keyloggers hide their malicious behaviors to defeat run-time detection. In this paper, based on the analysis of the evasion mechanisms used by common software keyloggers, we established a framework for their detection. Using an enticement strategy, the framework we built could induce keyloggers exhibited more obvious malicious activities by mimicking user keystrokes. These ‘amplified’ activities are then correlated by the dendritic cell algorithm (an immune-inspired algorithm) to final determine the existence of a keylogger in a host. Preliminary experimental results showed that the framework could improve the performance of keylogger detection and hard to evade.

Index Terms—keylogger, keystroke simulation, dendritic cell algorithm (DCA), correlation

[PDF]

Cite: Jun Fu, Huan Yang, Yiwen Liang, Chengyu Tan, "Enhancing Keylogger Detection Performance of the Dendritic Cell Algorithm by an Enticement Strategy," Journal of Computers vol. 9, no. 6, pp. 1347-1354, 2014.