Abstract:As computing systems become increasingly advanced and as users increasingly engage themselves in technology, security has never been a greater concern. In malware detection, static analysis, the method of analyzing potentially malicious files, has been the prominent approach. This approach, however, quickly falls short as malicious programs become more advanced and adopt the capabilities of obfuscating its binaries to execute the same malicious functions, making static analysis extremely difficult for newer variants. The approach assessed in this paper is a novel dynamic malware analysis method, which may generalize better than static analysis to newer variants. Inspired by recent successes in Natural Language Processing (NLP), widely used document classification techniques were assessed in detecting malware by doing such analysis on system calls, which contain useful information about the operation of a program as requests that the program makes of the kernel. Features considered are extracted from system call traces of benign and malicious programs, and the task to classify these traces is treated as a binary document classification task of system call traces. The system call traces were processed to remove the parameters to only leave the system call function names. The features were grouped into various n-grams and weighted with Term Frequency-Inverse Document Frequency. This paper shows that Linear Support Vector Machines (SVM) optimized by Stochastic Gradient Descent and the traditional Coordinate Descent on the Wolfe Dual form of the SVM are effective in this approach, achieving a highest of 96% accuracy with 95% recall score. Additional contributions include the identification of significant system call sequences that could be avenues for further research.

Malware Behavioural Detection and Vaccine Development by Using a Support Vector Model Classifier.

A Dynamic and Static Combined Android Malicious Code Detection Model Based on SVM.

Malware Detection Using Bilayer Behavior Abstraction and Improved One-Class Support Vector Machines

Towards Building an Intelligent Anti-Malware System: A Deep Learning Approach using Support Vector Machine (SVM) for Malware Classification

Collaborative Support Vector Machine for Malware Detection

Malware Analysis Using Machine Learning and Deep Learning Techniques

Behavior-based malicious executables detection by multi-class SVM

Automatic Malware Classification and New Malware Detection Using Machine Learning

Behavior-based Virus Detection Method Using Multi-Class Support Vector Machine

Android malware detection based on SVM

Malware Analysis and Detection Using Machine Learning Algorithms

Evaluation of Machine Learning Algorithms for Malware Detection

Unknown Malware Detection Based on the Full Virtualization and SVM

Large-scale Malware Automatic Detection Based on Multiclass Features and Machine Learning.

Malware Detection and Classification Using Machine Learning Algorithms

An Android Malware Detection System Based on Machine Learning

A Novel Approach for Mobile Malware Classification and Detection in Android Systems.

Advanced Cybersecurity Enhancement through Mathematical Models: A Comprehensive Approach Using Statistical Methods, Cryptographic Techniques, and Machine Learning Algorithms (SVM, Random Forest, and Neural Networks) for Behavior-Based Malware Detection

NtMalDetect: A Machine Learning Approach to Malware Detection Using Native API System Calls

Behavior-Based Malware Detection on Mobile Phone

A Study of Malware Detection on Smart Mobile Devices