Features Engineering for Malware Family Classification Based API Call

Abstract

Malware is used to carry out malicious operations on networks and computer systems. Consequently, malware classification is crucial for preventing malicious attacks. Application programming interfaces (APIs) are ideal candidates for characterizing malware behavior. However, the primary challenge is to produce API call features for classification algorithms to achieve high classification accuracy. To achieve this aim, this work employed the Jaccard similarity and visualization analysis to find the hidden patterns created by various malware API calls. Traditional machine learning classifiers, i.e., random forest (RF), support vector machine (SVM), and k-nearest neighborhood (KNN), were used in this research as alternatives to existing neural networks, which use millions of length API call sequences. The benchmark dataset used in this study contains 7107 samples of API call sequences (labeled to eight different malware families). The results showed that RF with the proposed API call features outperformed the LSTM (long short-term memory) and gated recurrent unit (GRU)-based methods against overall evaluation metrics.

TTDAT: Two-Step Training Dual Attention Transformer for Malware Classification Based on API Call Sequences

“…The first five methods are classic methods [14,[44][45][46][47] to do the malware family classification, and we report the results from their papers. The following five methods [16,20,21,23,48] are the latest effective work on the classification based on API calls, so we reproduce the methods and offer a convincing comparison result. The [21] method adopts a two-way feature extraction architecture for API calls, but the core module is a multi-layer CNN, and the correlation analysis is performed through Bi-LSTM.…”

“…The results of their endeavors demonstrate significant performance enhancements when compared to baseline methodologies, highlighting the efficacy of introducing additional intrinsic features associated with APIs. Some works consider the similarity among the features, especially API call sequences, and employ similarity to do the encoder, followed by some advanced models such as GNN [22], Random Forest, LSTM [23], and F-RCNN [24].…”

“…Malware Image + GIST [44] File content 63,002 531 0.7280 Malware Image + CNN [45] File content 10,868 9 0.9176 Malware Image + GRU-SVM [46] File content 9339 25 0.8492 BBIS + CARL [47] API calls 3131 28 0.8840 (F1) NLP(TF-IDF) + SVM [14] API calls 23,080 10 0.8654 Category Vector + CNN [16] API calls 23,080 10 0.8797 Frequence Vector + RF [23] API In Table 5, we further compared the performance of the latest seven methods on the second dataset to demonstrate the robustness and broad performance of the model. From Table 5, the performance of all three models has decreased on the second dataset, but our proposed method still performs the best.…”

Dynamic Malware Classification and API Categorisation of Windows Portable Executable Files Using Machine Learning

“…Hansen et al [26] employed API call sequences and frequency to identify and classify malware by utilising the Random Forest classifier. Daeef et al [27] proposed a method to uncover the underlying patterns of malicious behaviour among different malware families by utilising the Jaccard index and visualisation techniques. J. Singh et al [28] and Albishry et al [29] explained how ML techniques have been widely utilised in the field of malware detection.…”

An Investigation of Quantum and Parallel Computing Effects on Malware Families Classification

“…The results of a recent research [1,2] carried out by AV-TEST reveal that more than 9 million new instances of malicious software have been launched, and that there are presently 1363.92 million detected instances of malicious software functioning in the environment. These results underline the need for significant and continuing technological improvement in order to avoid the emergence of new dangers.…”