MalSPM: Metamorphic malware behavior analysis and classification using sequential pattern mining

doi:10.1016/j.cose.2022.102741

MalSPM: Metamorphic malware behavior analysis and classification using sequential pattern mining

2022-07-01

16

PRE

AI

M

M. Saqib Nawaz

P

Philippe Fournier‐Viger *

DOI：10.1016/j.cose.2022.102741

Original

Original request for help

Save

Abstract

En 中文

Malware pose a serious threat to the computers of individuals, enterprises and other organizations. In the Windows operating system (OS), Application Programming Interface (API) calls are an attractive and distinguishable feature for malware analysis and detection as they can properly reflect the actions of portable executable (PE) files. In this paper, we propose MalSPM, an intelligent malware detection system based on sequential pattern mining (SPM) for the analysis and classification of malware behavior during executions. A dataset that contains sequences of API calls made by different malware on Windows OS is abstracted into a suitable format. SPM algorithms are first used on the corpus to find frequent API calls and their patterns. Moreover, sequential rules between API calls patterns as well as maximal and closed frequent API calls patterns are discovered. Obtained frequent patterns are then used for the classification of different malware. Seven classifiers are used and their performance is compared by using various metrics. Moreover, the performance of MalSPM is compared with existing state-of-the-art malware detection approaches and obtained results show that MalSPM outperforms these approaches.(c) 2022 Elsevier Ltd. All rights reserved.

Keywords:

Malware

API calls

Sequential pattern mining

Frequent patterns

Classification

MalSPM: Metamorphic malware behavior analysis and classification using sequential pattern mining

Abstract

Journal

Organization