Cross-Method-Based Analysis and Classification of Malicious Behavior by API Calls Extraction

Abstract

Data-driven public security networking and computer systems are always under threat from malicious codes known as malware; therefore, a large amount of research and development is taking place to find effective countermeasures. These countermeasures are mainly based on dynamic and statistical analysis. Because of the obfuscation techniques used by the malware authors, security researchers and the anti-virus industry are facing a colossal issue regarding the extraction of hidden payloads within packed executable extraction. Based on this understanding, we first propose a method to de-obfuscate and unpack the malware samples. Additional, cross-method-based big data analysis to dynamically and statistically extract features from malware has been proposed. The Application Programming Interface (API) call sequences that reflect the malware behavior of its code have been used to detect behavior such as network traffic, modifying a file, writing to stderr or stdout, modifying a registry value, creating a process. Furthermore, we include a similarity analysis and machine learning algorithms to profile and classify malware behaviors. The experimental results of the proposed method show that malware detection accuracy is very useful to discover potential threats and can help the decision-maker to deploy appropriate countermeasures.

An Ensemble-Based Malware Detection Model Using Minimum Feature Set

“…However, dynamic analysis approaches are also imperfect. It is reported in [3,[5][6][7][8][9] that smart malware can detect whether it runs on a virtual or real environment. Moreover, smart malware can modify their behavior by hiding their malicious code to avoid detection.…”

“…Evaluations in [19] showed that the classification performance is downgraded from 97% to 20% when classifying obfuscated codes. Bruce Ndibanje et al [3] proposed a hybrid static/dynamic model for unpacking and de-obfuscating malware to make use of static data. They also address the behavior analysis of malware by analyzing API call sequence that makes it possible to understand malware behavior.…”

“…Unknown vulnerabilities allow an attack window time, that is the time between threat discovery to signature update. It is shown in [2][3][4][5][6] that malware authors use tools to pack and obfuscate malware to hide malware and to escape from detection. Consequently, signature-based approaches are inefficient to cope with malware authors tricks and therefore, they are unreliable.…”

Decision-Making Method for Estimating Malware Risk Index

“…However, in contrast to our method, it is difficult to estimate the magnitude of the risk of the malicious code, because it is not accompanied by quantitative semantics and analysis of such MAs. B. Ndibanje [34] proposed a method for analyzing and detecting the API call sequence for MAs through obfuscation analysis and unpacking of malicious code. However, in contrast to the present study, that study mainly focused on ways to improve the detection accuracy; i.e., a potential risk analysis for various new strains of malicious code was not performed.…”

Advanced Windows Methods on Malware Detection and Classification

“…Consequently, most of the available API-based malware detection approaches ignore the API arguments in their feature extraction techniques [14,16,25,36]. API-based malware detection has received significant attention from researchers [22,24,35,38,40,41,54]. In literature, API-based malware detection has made its advances during three distinct stages.…”