Abstract:Malware is a serious cyber security threat that is extremely difficult to combat. Over the past few years, the frequency of malware attacks has increased manifold and is expected to grow further in the coming years. Many studies suggest API call sequences generated by a process can serve as an effective tool for malware detection. However, most of the existing works based on API call sequences suffer from high dimensional feature sets. This paper proposes a novel API call sequences based malware detection model, MalAnalyser, to address these issues. To reduce the computational overhead involved with the extensive original call sequences, MalAnalyser extracts frequent API call subsequences (patterns) as features for differentiating malware from benign processes, as they encompass the most representative and valuable behavioural information of a process. The model then uses Global Local Best Particle Swarm Optimization (GLBPSO) for identifying the discriminatory features with an objective of reducing computational overhead of the malware detection algorithm without jeopardizing the detection accuracy. Extensive experimentation performed on benign and malware samples exhibit that the proposed model delivers better performance in comparison to the current state-of-the-art models. Experiments conducted on the complete feature set as well as a set of randomly selected 60% features as input, exhibit a detection accuracy of up to 99.71% on both the sets with up to 50.52% and 74.46% reduction in size of feature set respectively. Another major contribution of this work is detection of rare or unseen malware behavior by generating new malware patterns from the existing patterns using Genetic Algorithm. MalAnalyser reported a significant performance gain with this enriched feature set and attained up to 100% accuracy with up to 70% reduced feature set. Further, effectiveness of MalAnalyser is evaluated for detecting a specific type of malware i.e. ransomware.

TS-Mal: Malware Detection Model Using Temporal and Structural Features Learnin

TI-MVD: A temporal interaction-enhanced model for malware variants detection

DMalNet: Dynamic malware analysis based on API feature engineering and graph learning

Dynamic Malware Analysis Based on API Sequence Semantic Fusion

Channel Features and API Frequency-Based Transformer Model for Malware Identification

Comprehensive evaluation of Mal-API-2019 dataset by machine learning in malware detection

Artificial Intelligence-Based Malware Detection, Analysis, and Mitigation

A novel deep framework for dynamic malware detection based on API sequence intrinsic features

A Hybrid Deep Learning Model for Malicious Behavior Detection

Reliable Malware Analysis and Detection using Topology Data Analysis

Mitigating the Impact of Malware Evolution on API Sequence-based Windows Malware Detector

A novel malware detection method based on API embedding and API parameters

Discovering Malicious Signatures in Software from Structural Interactions

Malware Analysis and Detection Using Machine Learning Algorithms

A dynamic Windows malware detection and prediction method based on contextual understanding of API call sequence

Malware Detected and Tell MeWhy: An Verifiable Malware Detection Model with Graph Metric Learning

An Efficient DenseNet-Based Deep Learning Model for Malware Detection

TCN-ATT: A Non-recurrent Model for Sequence-Based Malware Detection

Malanalyser: An Effective and Efficient Windows Malware Detection Method Based on Api Call Sequences

API Sequences Based Malware Detection for Android.

EarlyMalDetect: A Novel Approach for Early Windows Malware Detection Based on Sequences of API Calls