A Novel Approach to Detect Malware Based on API Call Sequence Analysis

Ki, Youngjoon; Kim, Eun Jin; Kim, Huy Kang

doi:10.1155/2015/659101

Cited by 190 publications

(100 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Here, they follow a reverse engineering approach to detect the malware. Many researchers used API call sequences to analyze behavior of portable executable (PE) code 10,8 . Most of these techniques fail due to use of obfuscation techniques for development of malware.…”

Section: Related Workmentioning

confidence: 99%

“…For an unknown sample, its profile is compared to a known profile for finding its similarity and predict family of malware sample. Dynamic techniques involve generation of a profile of malware samples either by analyzing control flows or API calls 10 . Both of these profile generation approaches involve finding the similarity of test samples with an existing profile.…”

Section: Related Workmentioning

confidence: 99%

“…These techniques involve establishment of a signature database. The major limitation is that these techniques fail to detect a novel malware until its signature is updated 4,18,10 . Whereas, dynamic techniques analyze the malware samples during its execution.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Evaluation of Supervised Machine Learning Techniques for Dynamic Malware Detection

Zhao¹,

Li²,

Taiqi³

et al. 2018

IJCIS

View full text Add to dashboard Cite

Nowadays, security of the computer systems has become a major concern of security experts. In spite of many antivirus and malware detection systems, the number of malware incidents are increasing day by day. Many static and dynamic techniques have been proposed to detect the malware and classify them into malware families accurately. The dynamic malware detection has potential benefits over the static ones to detect malware effectively. Because, it is difficult to mask behavior of malware while executing than its underlying code in static malware detection. Recently, machine learning techniques have been the main focus of the security experts to detect malware and predict their families dynamically. But, to the best of our knowledge, there exists no comprehensive work that compares and evaluates a sufficient number of machine learning techniques for classifying malware and benign samples. In this work, we conducted a set of experiments to evaluate machine learning techniques for detecting malware and their classification into respective families dynamically. A set of real malware samples and benign programs have been received from VirusTotal, and executed in a controlled & isolated environment to record malware behavior for evaluation of machine learning techniques in terms of commonly used performance metrics. From the execution reports saved in the form of JSON reports, we extract a promising set of features representing behavior of a malware sample. The identified set of features is further employed to classify malware and benign samples. The Major motivation of this work is that different techniques have been designed to optimize different criteria. So, they behave differently, even in similar conditions. In addition to classification of malware and benign samples dynamically, we reveal guidelines for researchers to apply machine learning techniques for detecting malware dynamically, and directions for further research in the field.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Evaluation of Supervised Machine Learning Techniques for Dynamic Malware Detection

Zhao¹,

Li²,

Taiqi³

et al. 2018

IJCIS

View full text Add to dashboard Cite

show abstract

“…Detours, originally provided by Microsoft as a library, is very popular and used in various different projects such as Ref. [29]. the execution sequence of a Detours setup.…”

Section: Inline Function Patchingmentioning

confidence: 99%

The Evolution of Process Hiding Techniques in Malware - Current Threats and Possible Countermeasures

Eresheim

Luh

Schrittwieser

2017

Journal of Information Processing

View full text Add to dashboard Cite

Rootkits constitute a significant threat to modern computing and information systems. Since their first appearance in the early 1990's they have steadily evolved, adapting to ever-improving security measures. The main feature rootkits have in common is the ability to hide their malicious presence and activities from the operating system and its legitimate users. In this paper we systematically analyze process hiding techniques routinely used by rootkit malware. We summarize the characteristics of different approaches and discuss their advantages and limitations. Furthermore, we assess detection and prevention techniques introduced in operating systems in response to the threat of hidden malware. The results of our assessments show that defenders still struggle to keep up with rootkit authors. At the same time we see a shift towards powerful VM-based techniques that will continue to evolve over the coming years.

show abstract

“…In [9] to capture the common API sequence among different malware categories, the longest common sequence (LCS) algorithm is used. The captured sequences are treated as the signature.…”

Section: Introductionmentioning

confidence: 99%