Comparative Analysis of Feature Extraction Methods of Malware Detection

Ranveer, Smita; Hiray, Swapnaja

doi:10.5120/21220-3960

Cited by 46 publications

(30 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Since there is no classification system available in literature for the above mentioned categories, so we have given comparison of our system with malware vs benign classifiers [11,12], which are much simpler. Table 4 gives the classification accuracy and FPR for these five 2-class problems, and Table 5 gives the accuracy & FPR for 2 class classifier problems (Malware vs Benign) [11,12]. These classification results indicate that there exist class specific signatures for every class which can be extracted manually by thorough inspection.…”

Section: Classification Results and Analysismentioning

confidence: 99%

See 1 more Smart Citation

Malware Characterization Using WindowsAPI Call Sequences

Gupta¹,

Sharma²,

Kaur³

2018

JCSM

View full text Add to dashboard Cite

In this research we have used Windows API (Win-API) call sequences to capture the behaviour of malicious applications. Detours library by Microsoft has been used to hook the Win-APIs call sequences. To have a higher level of abstraction, related Win-APIs have been mapped to a single category. A total set of 534 important Win-APIs have been hooked and mapped to 26 categories (A.. . Z). Behaviour of any malicious application is captured through sequence of these 26 categories of APIs. In our study, five classes of malware have been analyzed: Worm, Trojan-Downloader, Trojan-Spy, Trojan-Dropper and Backdoor. 400 samples for each of these classes have been taken for experimentation. So a total of 2000 samples were taken as training set and their API call sequences were analyzed. For testing, 120 samples were taken for each class. Fuzzy hashing algorithm ssdeep was applied to generate fuzzy hash based signature. These signatures were matched to quantify the API call sequence homologies between test samples and training samples. Encouraging results have been obtained in classification of these samples to the above mentioned 5 categories. Further, N-gram analysis has also been done to extract different API call sequence patterns specific to each of the 5 categories of malware.

show abstract

Section: Classification Results and Analysismentioning

confidence: 99%

“…Gandotra et al [10] gave extensive survey of various researches related to malware classification. Ranveer and Hirai [11] categorized various features used in the malware detection systems. They have compared features of static, dynamic and hybrid type.…”

Section: Introductionmentioning

confidence: 99%

Malware Characterization Using WindowsAPI Call Sequences

Gupta¹,

Sharma²,

Kaur³

2018

JCSM

View full text Add to dashboard Cite

show abstract

“…Those metrics are discovered during malware interactions with the underlying system. Such metrics can be utilized to detect a possible attack [17].…”

Section: Related Workmentioning

confidence: 99%

An Ensemble-Based Malware Detection Model Using Minimum Feature Set

Zelinka

Amer²

2019

mendel

View full text Add to dashboard Cite

Current commercial antivirus detection engines still rely on signature-based methods. However, with the huge increase in the number of new malware, current detection methods become not suitable. In this paper, we introduce a malware detection model based on ensemble learning. The model is trained using the minimum number of signification features that are extracted from the file header. Evaluations show that the ensemble models slightly outperform individual classification models. Experimental evaluations show that our model can predict unseen malware with an accuracy rate of 0.998 and with a false positive rate of 0.002. The paper also includes a comparison between the performance of the proposed model and with different machine learning techniques. We are emphasizing the use of machine learning based approaches to replace conventional signature-based methods.

show abstract

“…Several previous studies have shown promising results using ML algorithms to detect malware [16] or to differentiate between different families of malware [9]. There are two common approaches to extract features from malware: static analysis and dynamic analysis [6].…”

Section: Related Workmentioning

confidence: 99%

Dynamic Analysis of Executables to Detect and Characterize Malware

Smith

Ingram

Lamb

et al. 2018

2018 17th IEEE International Conference on Machine Learning and Applications (ICMLA)

View full text Add to dashboard Cite

Malware detection and remediation is an on-going task for computer security and IT professionals. It is needed to ensure the integrity of systems that process sensitive information and control many aspects of everyday life. We examine the use of machine learning algorithms to detect malware using the system calls generated by executables-alleviating attempts at obfuscation as the behavior is monitored rather than the bytes of an executable. We examine several machine learning techniques for detecting malware including random forests, deep learning techniques, and liquid state machines. The experiments examine the effects of concept drift on each algorithm to understand how well the algorithms generalize to novel malware samples by testing them on data that was collected after the training data. The results suggest that each of the examined machine learning algorithms is a viable solution to detect malware-achieving between 90% and 95% class-averaged accuracy (CAA). In real-world scenarios, the performance evaluation on an operational network may not match the performance achieved in training. Namely, the CAA may be about the same, but the values for precision and recall over the malware can change significantly. We structure experiments to highlight these caveats and offer insights into expected performance in operational environments. In addition, we use the induced models to gain a better understanding about what differentiates the malware samples from the goodware, which can further be used as a forensics tool to understand what the malware (or goodware) was doing to provide directions for investigation and remediation.

show abstract

Comparative Analysis of Feature Extraction Methods of Malware Detection

Cited by 46 publications

References 26 publications

Malware Characterization Using WindowsAPI Call Sequences

Malware Characterization Using WindowsAPI Call Sequences

An Ensemble-Based Malware Detection Model Using Minimum Feature Set

Dynamic Analysis of Executables to Detect and Characterize Malware

Contact Info

Product

Resources

About