Feature-Chain Based Malware Detection Using Multiple Sequence Alignment of API Call

Abstract

SUMMARYThe recent cyber-attacks utilize various malware as a means of attacks for the attacker's malicious purposes. They are aimed to steal confidential information or seize control over major facilities after infiltrating the network of a target organization. Attackers generally create new malware or many different types of malware by using an automatic malware creation tool which enables remote control over a target system easily and disturbs trace-back of these attacks. The paper proposes a generation method of malware behavior patterns as well as the detection techniques in order to detect the known and even unknown malware efficiently. The behavior patterns of malware are generated with Multiple Sequence Alignment (MSA) of API call sequences of malware. Consequently, we defined these behavior patterns as a "feature-chain" of malware for the analytical purpose. The initial generation of the feature-chain consists of extracting API call sequences with API hooking library, classifying malware samples by the similar behavior, and making the representative sequences from the MSA results. The detection mechanism of numerous malware is performed by measuring similarity between API call sequence of a target process (suspicious executables) and feature-chain of malware. By comparing with other existing methods, we proved the effectiveness of our proposed method based on Longest Common Subsequence (LCS) algorithm. Also we evaluated that our method outperforms other antivirus systems with 2.55 times in detection rate and 1.33 times in accuracy rate for malware detection.

Toward machine intelligence that learns to fingerprint polymorphic worms in IoT

“…Kim et al used MSA to generate malware behavioral "feature-chain" patterns. 21 To deal with some obfuscation techniques, such as encoding, antivirtualization, and encapsulation, used by polymorphic worms, Kim et al implemented a detection system using API and MSA, 22 which achieved higher performance in terms of precision, accuracy, and false positive. The main drawback of these methods is that they need a huge amount of memory and have a high computational complexity.…”

“…This method adopts dynamic information of API call sequence patterns instead of malware's static information, such as file size, process, and it can even be used to detect new unknown malware. Kim et al used MSA to generate malware behavioral “feature‐chain” patterns 21 . To deal with some obfuscation techniques, such as encoding, antivirtualization, and encapsulation, used by polymorphic worms, Kim et al implemented a detection system using API and MSA, 22 which achieved higher performance in terms of precision, accuracy, and false positive.…”

Implementation of Malware Detection System Based on Behavioral Sequences

“…1. For more explanation about each step, refer to our previous paper [5].  Data Collection & Sequence Extraction: Our malware samples had been collected from the web site such as "malshare.com" [3] and "VXVolt.net" [4].…”