MalPro: Learning on Process-Aware Behaviors for Malware Detection

Chen, Xiaohui; Tong, Ying; Du, Chunlai; Liu, Yongji; Ding, Zhenquan; Ran, Qingyun; Zhang, Yi; Cui, Lei; Hao, Zhiyu

doi:10.1109/iscc55528.2022.9913030

Cited by 6 publications

(3 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Compared with our previously proposed model MalPro [35], our proposed model in this paper achieves a total of 0.85%, 0.82%, 0.85% and 0.84% improvement in Accuracy, Precision, Recall and F1-Score in the test results on DataSet2 respectively, showing a great generalization ability in malware detection. Te results also indicate that our eforts on the API scores can further assist the DNN in accurate malware detection.…”

Section: Comparison With State-of-the-artmentioning

confidence: 78%

“…In order to investigate the performance improvement, we conduct comprehensive experiments among our method, classic decision tree algorithm with raw API sequence, Zhang et al [6] proposed model with raw API sequence and run-time arguments, and previously proposed model MalPro [35] with process-aware behaviors respectively. All the experiments are conducted on our dataset.…”

Section: Comparison With State-of-the-artmentioning

confidence: 99%

See 1 more Smart Citation

Toward Detecting Malware Based on Process-Aware Behaviors

Tong

Chen

et al. 2023

Security and Communication Networks

View full text Add to dashboard Cite

Malware continuously evolve and become more and more sophisticated. Learning on execution behavior is proven to be effective for malware detection. However, little work has been done to delve into the implications of full process information for malware detection. In this paper, we present a deep neural network based malware detection approach that performs learning on process-aware behaviors for Windows programs. It first employs logistic regression-based weighting method and machine learning-based API score learning method to aware the inner-process behavior, including API sequences and their run-time arguments. Next, it constructs the process graph by inter-process interactions from which a set of attributes are extracted, for characterizing the relationship among various processes in term of invoke actions. Finally, it feeds the process-aware features into the deep neural network for training a binary classifier to detect malware. In addition to designing, we have implemented and evaluated our proposed method on two datasets. The results demonstrate that our method outperforms naïve models when taking raw APIs as input, verifying the effectiveness of our method. Moreover, we have evaluated the robustness to adversarial attacks and concept drift on our model, and the results demonstrates the robustness of our method.

show abstract

Section: Comparison With State-of-the-artmentioning

confidence: 78%

Section: Comparison With State-of-the-artmentioning

confidence: 99%

Toward Detecting Malware Based on Process-Aware Behaviors

Tong

Chen

et al. 2023

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…Chen et al [ 21 ] proposed a deep neural network (DNN)-based method for malware detection called MalPro. MalPro utilizes a logic-regression-based approach to calculate a weight value representing the sensitivity of API pairs to malicious behavior.…”

Section: Related Workmentioning

confidence: 99%

Channel Features and API Frequency-Based Transformer Model for Malware Identification

Qian,

Cong

2024

Sensors

View full text Add to dashboard Cite

Malicious software (malware), in various forms and variants, continues to pose significant threats to user information security. Researchers have identified the effectiveness of utilizing API call sequences to identify malware. However, the evasion techniques employed by malware, such as obfuscation and complex API call sequences, challenge existing detection methods. This research addresses this issue by introducing CAFTrans, a novel transformer-based model for malware detection. We enhance the traditional transformer encoder with a one-dimensional channel attention module (1D-CAM) to improve the correlation between API call vector features, thereby enhancing feature embedding. A word frequency reinforcement module is also implemented to refine API features by preserving low-frequency API features. To capture subtle relationships between APIs and achieve more accurate identification of features for different types of malware, we leverage convolutional neural networks (CNNs) and long short-term memory (LSTM) networks. Experimental results demonstrate the effectiveness of CAFTrans, achieving state-of-the-art performance on the mal-api-2019 dataset with an F1 score of 0.65252 and an AUC of 0.8913. The findings suggest that CAFTrans improves accuracy in distinguishing between various types of malware and exhibits enhanced recognition capabilities for unknown samples and adversarial attacks.

show abstract