.png){kind=icon}
返回
CruParamer: Learning on Parameter-Augmented API Sequences for Malware Detection
.png){kind=icon}
PRE
AI
DOI：10.1109/TIFS.2022.3152360.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Learning on execution behaviour, i.e., sequences of API calls, is proven to be effective in malware detection. In this paper, we present CruParamer, a deep neural network based malware detection approach for Windows platform that performs learning on sequences of parameter-augmented APIs. It first employs rule-based and clustering-based classification to assess the sensitivity of a parameter to malicious behaviour, and further labels the API following the run-time parameters with varying degrees of sensitivities. Then, it encodes the APIs by concatenating the native embedding and the sensitive embedding of labelled APIs, for characterizing the relationship between successive labelled APIs and their correspondence in terms of security semantics. Finally, it feeds the sequences of API embedding into the deep neural network for training a binary classifier to detect malware. In addition to presenting the design, we have implemented CruParamer and evaluated it on two datasets. The results demonstrate that CruParamer outperforms naive models when taking raw APIs as input, proving the effectiveness of CruParamer. Moreover, we have evaluated the impact of mimicry and adversarial attacks on our model, and the results verify the robustness of CruParamer.
Keyword:
Malware
Semantics
Security
Sensitivity
Labeling
Feature extraction
Deep learning
Malware detection
API sequence
run-time parameter
word embedding
deep learning
期刊
IF:
8
论文数:
5.2K
被引数:
2.3W
机构
引用论文
A dynamic Windows malware detection and prediction method based on contextual understanding of API call sequence基于API调用序列上下文理解的Windows恶意软件动态检测与预测方法.png)
COMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
分享收藏分享收藏
查看更多内容