Classification of Malware Families Based on Runtime Behaviour

Abstract

This paper distinguishes malware families from a specific category (i.e., ransomware) via dynamic analysis. We collect samples from four ransomware families and use Cuckoo sandbox environment, to observe their runtime behaviour. This study aims to provide new insight into malware family classification by comparing possible runtime features, and application of different extraction and selection techniques on them. As we try many extraction models on call traces such as bag-ofwords, ngram sequences and wildcard patterns, we also look for other behavioural features such as files, registry and mutex artefacts. While wildcard patterns on call traces are designed to overcome advanced evasion strategies such as the insertion of junk API calls (causing ngram searches to fail), for the models generating too many features, we adapt new feature selection techniques with a classwise fashion to avoid unfair representation of families in the feature set which leads to poor detection performance. To our knowledge, no research paper has applied a classwise approach to the multi-class malware family identification. With a 96.05% correct classification ratio for four families, this study outperforms most studies applying similar techniques.

A Distance-Based Method for Building an Encrypted Malware Traffic Identification Framework

“…The traditional malware classification is mostly based on the host behavior of malware [19]- [21], for example, API-call sequences or created processes. On the basis of these features, the classification methods are constantly updated.…”

A Short Survey on Malware Behavioural Features Collection from AgTech Environments

“…Geden Happa (2018) in [32] conducted an experiment to classify particular malware into malware families from the outcomes of dynamic behaviour analysis. For their experiment, they established an automated dynamic malware analysis platform with the help of the Cuckoo tool.…”