.png){kind=icon}
.png){kind=icon}
Return
DMalNet: Dynamic malware analysis based on API feature engineering and graph learning
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2022.102872.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Application Programming Interfaces (APIs) are widely considered a useful data source for dynamic mal-ware analysis to understand the behavioral characteristics of malware. However, the accuracy of API -based malware analysis is limited for two reasons. (1) Existing solutions often only consider the API names while ignoring the API arguments, or cannot fully exploit the semantic information from different types of arguments. (2) The relationship between API calls is important to describe the software behav-ior but is difficult to capture. To overcome the above limitations, we propose DMalNet, a novel malware analysis framework for accurate malware detection and classification. Specifically, we first present a hy-brid feature encoder to extract semantic features from API names and arguments. Then, we derive an API call graph from the API call sequence to convert the relationship between API calls into the structural information of the graph. Finally, we design a graph neural network to implement the malware detection and type classification. To evaluate our approach, we use datasets of over 20k benign and 18k malicious samples belonging to 8 malware types. DMalNet achieves 98.43% and 91.42% accuracy on malware detec-tion and malware type classification, respectively. We also conduct ablation studies to assess the impact of API feature engineering and the graph learning model. Further experiments show that DMalNet can effectively detect malware.(c) 2022 Elsevier Ltd. All rights reserved.
Keywords:
Malware detection
Malware type classification
API Feature engineering
API Call graph
Deep learning
Graph neural network
Journal
C
IF:
5.4
Papers:
4.6K
Citations:
1.4W