.png){kind=icon}
返回
Feature mining and classifier selection for API calls-based malware detection
.png){kind=icon}
PRE
AI
DOI：10.1007/s10489-023-05086-2.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
This paper deals with a major challenge in cyber-security: the need to respond to ever renewed techniques used by attackers in order to avoid detection based on analysing static features of malware. These constantly renewed techniques consist of various changes in file geometry, entropy a.s.o. As a consequence, static malware features sets describe less and less accurately the malicious files; hence, the performance of machine learning models in detecting new variants of the same malware family may be severely impaired. The paper focuses on a promising approach to this detection challenge: defining file features based on OS (operating system) API (Application Program Interface) calls sequences. We explore in detail the detection potential of such features, since, in order to act maliciously, these features are highly unlikely to be hidden. We studied several tens of thousands of such features, a modest-sized subset of which were subsequently fed to several machine learning models. The database used for training and testing consists of 1.5 million files, including malicious files from the polymorphic families Emotet and Trickbot. Using this database, nearly 4,000 pairings (classifier, feature selection algorithm) were trained / tested. Our experimental results show that the API (Application Program Interface) calls-oriented feature mining process is well suited for detecting polymorphic malware. A comparative discussion of the detection results of the various models is presented; depending on the target optimisation criterion (detection rate / false positive rate / saving resources), three of the 4,000 classification models turn out to be best suited for real-world applications: Random Forrest, Legacy Neural Networks and Decision Tree.
Keyword:
Malware detection
Feature mining
Behavioural features
API calls
Emulators
期刊
IF:
3.5
论文数:
7.6K
被引数:
1.7W
机构
引用论文
DMalNet: Dynamic malware analysis based on API feature engineering and graph learningDMalNet: 基于API特征工程和图学习的动态恶意软件分析.png)
COMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
分享收藏Improvement of malware detection and classification using API call sequence alignment and visualization使用API调用序列比对和可视化改进恶意软件检测和分类
PREAI
分享收藏
Redox behaviour of mixed-ligand five-coordinate cobalt(I) complexes with isocyanides and phosphines
PREAI
分享收藏
分享收藏
查看更多内容