Malware Detection Based on Structural and Behavioural Features of API Calls
نویسندگان
چکیده
In this paper, we propose a five-step approach to detect obfuscated malware by investigating the structural and behavioural features of API calls. We have developed a fully automated system to disassemble and extract API call features effectively from executables. Using n-gram statistical analysis of binary content, we are able to classify if an executable file is malicious or benign. Our experimental results with a dataset of 242 malwares and 72 benign files have shown a promising accuracy of 96.5% for the unigram model. We also provide a preliminary analysis by our approach using support vector machine (SVM) and by varying n-values from 1 to 5, we have analysed the performance that include accuracy, false positives and false negatives. By applying SVM, we propose to train the classifier and derive an optimum n-gram model for detecting both known and unknown malware efficiently.
منابع مشابه
DyVSoR: dynamic malware detection based on extracting patterns from value sets of registers
To control the exponential growth of malware files, security analysts pursue dynamic approaches that automatically identify and analyze malicious software samples. Obfuscation and polymorphism employed by malwares make it difficult for signature-based systems to detect sophisticated malware files. The dynamic analysis or run-time behavior provides a better technique to identify the threat. In t...
متن کاملDetection of Malware on Android based on Application Features
Threat of mobile malware is increasing day by day. Since Android is the most popular and maximum sold mobile phone, there is an increasing threat of malware on Android based mobile device. The different antimalware products available in market can detect the malware in its original form. But they cannot detect the malware after applying some form of obfuscation or transformation to the malware....
متن کاملMdroid: Android Based Malware Detection Using Mcm Classifier
Malware analysis and detection has become a prime research area in the case of smartphones, particularly based on android due to its widespread usage and increase in the number of malwares involving huge monetary gains. The exploding number of Android malware calls for automated analysis of the systems. There are two common techniques used for detecting malware, signature based and behaviour ba...
متن کاملIntelligent Hybrid Approach for Android Malware Detection based on Permissions and API Calls
Android malware is rapidly becoming a potential threat to users. The number of Android malware is growing exponentially; they become significantly sophisticated and cause potential financial and information losses for users. Hence, there is a need for effective and efficient techniques to detect the Android malware applications. This paper proposes an intelligent hybrid approach for Android mal...
متن کاملBehavioural API based Virus Analysis and Detection
The growing number of computer viruses and the detection of zero day malware have been the concern for security researchers for a large period of time. Existing antivirus products (AVs) rely on detecting virus signatures which do not provide a full solution to the problems associated with these viruses. The use of logic formulae to model the behaviour of viruses is one of the most encouraging r...
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
عنوان ژورنال:
دوره شماره
صفحات -
تاریخ انتشار 2010