Abstract:Application Programming Interfaces (APIs) are still considered the standard accessible data source and core wok of the most widely adopted malware detection and classification techniques. API-based malware detectors highly rely on measuring API’s statistical features, such as calculating the frequency counter of calling specific API calls or finding their malicious sequence pattern (i.e., signature-based detectors). Using simple hooking tools, malware authors would help in failing such detectors by interrupting the sequence and shuffling the API calls or deleting/inserting irrelevant calls (i.e., changing the frequency counter). Moreover, relying on API calls (e.g., function names) alone without taking into account their function parameters is insufficient to understand the purpose of the program. For example, the same API call (e.g., writing on a file) would act in two ways if two different arguments are passed (e.g., writing on a system versus user file). However, because of the heterogeneous nature of API arguments, most of the available API-based malicious behavior detectors would consider only the API calls without taking into account their argument information (e.g., function parameters). Alternatively, other detectors try considering the API arguments in their techniques, but they acquire having proficient knowledge about the API arguments or powerful processors to extract them. Such requirements demand a prohibitive cost and complex operations to deal with the arguments. To overcome the above limitations, with the help of machine learning and without any expert knowledge of the arguments, we propose a light-weight API-based dynamic feature extraction technique, and we use it to implement a malware detection and type classification approach. To evaluate our approach, we use reasonable datasets of 7774 benign and 7105 malicious samples belonging to ten distinct malware types. Experimental results show that our type classification module could achieve an accuracy of , where our malware detection module could reach an accuracy of over , and outperforms many state-of-the-art API-based malware detectors.

On the Effectiveness of Binary Emulation in Malware Classification

State-based Sandbox Tool for Distributed Malware Detection with Avoid Techniques

Malware Analysis Using Machine Learning and Deep Learning Techniques

Adversarial Deep Learning for Robust Detection of Binary Encoded Malware

Enhancing Malware Classification Through Dynamic Behavioral Analysis, SIEM Integration, and Deep Learning

An effective approach for classification of advanced malware with high accuracy

Binary classification of malware by analyzing its behavior in the network using machine learning

Malware Detection Based on Multi-level and Dynamic Multi-feature Using Ensemble Learning at Hypervisor

Deep hybrid approach with sequential feature extraction and classification for robust malware detection

Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables

A Novel Malware Detection System Based On Machine Learning and Binary Visualization

Advanced Windows Methods on Malware Detection and Classification

MalwareTotal: Multi-Faceted and Sequence-Aware Bypass Tactics Against Static Malware Detection

Redefining Malware Sandboxing: Enhancing Analysis Through Sysmon and ELK Integration

Agent-based Vs Agent-less Sandbox for Dynamic Behavioral Analysis

Artificial Intelligence-Based Malware Detection, Analysis, and Mitigation

Enhancing Malware Detection by Integrating Machine Learning with Cuckoo Sandbox

An Efficient DenseNet-Based Deep Learning Model for Malware Detection

Mwsandbox: On Improving The Efficiency Of Automated Coarse-Grained Dynamic Malware Analysis

Going beyond API Calls in Dynamic Malware Analysis: A Novel Dataset

A Comparison of State-of-the-Art Techniques for Generating Adversarial Malware Binaries