An automated classification system based on the strings of trojan and virus families

Abstract

Classifying malware correctly is an important research issue for anti-malware software producers. This paper presents an effective and efficient malware classification technique based on string information using several wellknown classification algorithms. In our testing we extracted the printable strings from 1367 samples, including unpacked trojans and viruses and clean files. Information describing the printable strings contained in each sample was input to various classification algorithms, including treebased classifiers, a nearest neighbour algorithm, statistical algorithms and AdaBoost. Using k-fold cross validation on the unpacked malware and clean files, we achieved a classification accuracy of 97%. Our results reveal that strings from library code (rather than malicious code itself) can be utilised to distinguish different malware families.

Comparative Analysis of Feature Extraction Methods of Malware Detection

“…Any malicious software for execution or replications invokes some kernel level system call to communicate with operating system; it is a sign of malicious activity. In [22,21,25], addressed automatic behavior analysis using Windows API calls, instruction set, control flow graph, function parameter analysis and system calls are used as features.…”

Malware Function Estimation Using API in Initial Behavior

“…Most of these studies used the static [3], [5], [10], [11], [13], [14], [17], [18], [21], [22], dynamic [4], [19] or hybrid [6] analysis methods. Actually, static analysis is becoming difficult because of the increasing sophistication of malware, and thus we focus on dynamic analysis approach.…”

A Scalable Malware Classification Based on Integrated Static and Dynamic Features

“…To this end, various data mining and machine learning approaches [21,28,14,19,25,5,6,18,27,9,20] have been applied to categorize malware into families based on different features derived from the analysis of the malware. Indeed, malware analysis involves two fundamental techniques: static and dynamic.…”

“…Features that are commonly gleaned from a static analysis of malware include Portable Executable (PE) header metadata such as Dynamic Link Library (DLL) [21] and API calls [28], bytes sequences (or n-grams) [21,14,29], Operational Codes (OpCodes) [19,22,24], strings [21,25,12], and function length and function length frequency [26]. Strings-based techniques were shown to achieve high detection and classification accuracy compared to PE and n-grams based techniques [21,25].…”

“…Strings-based techniques were shown to achieve high detection and classification accuracy compared to PE and n-grams based techniques [21,25]. Moreover, function length frequency features is significant in identifying the malware's family [13].…”