Abstract:Application Programming Interfaces (APIs) are still considered the standard accessible data source and core wok of the most widely adopted malware detection and classification techniques. API-based malware detectors highly rely on measuring API’s statistical features, such as calculating the frequency counter of calling specific API calls or finding their malicious sequence pattern (i.e., signature-based detectors). Using simple hooking tools, malware authors would help in failing such detectors by interrupting the sequence and shuffling the API calls or deleting/inserting irrelevant calls (i.e., changing the frequency counter). Moreover, relying on API calls (e.g., function names) alone without taking into account their function parameters is insufficient to understand the purpose of the program. For example, the same API call (e.g., writing on a file) would act in two ways if two different arguments are passed (e.g., writing on a system versus user file). However, because of the heterogeneous nature of API arguments, most of the available API-based malicious behavior detectors would consider only the API calls without taking into account their argument information (e.g., function parameters). Alternatively, other detectors try considering the API arguments in their techniques, but they acquire having proficient knowledge about the API arguments or powerful processors to extract them. Such requirements demand a prohibitive cost and complex operations to deal with the arguments. To overcome the above limitations, with the help of machine learning and without any expert knowledge of the arguments, we propose a light-weight API-based dynamic feature extraction technique, and we use it to implement a malware detection and type classification approach. To evaluate our approach, we use reasonable datasets of 7774 benign and 7105 malicious samples belonging to ten distinct malware types. Experimental results show that our type classification module could achieve an accuracy of , where our malware detection module could reach an accuracy of over , and outperforms many state-of-the-art API-based malware detectors.

A novel malware detection method based on API embedding and API parameters

A novel deep framework for dynamic malware detection based on API sequence intrinsic features

A Novel Approach to Detect Malware Based on API Call Sequence Analysis

A Model for Malware Detection Method Based on API Call Sequence Clustering

Dynamic Malware Detection Using Parameter-Augmented Semantic Chain

Advanced Windows Methods on Malware Detection and Classification

A dynamic Windows malware detection and prediction method based on contextual understanding of API call sequence

DMalNet: Dynamic malware analysis based on API feature engineering and graph learning

A Novel Android Malware Detection Method with API Semantics Extraction

A Real-Time and Adaptive-Learning Malware Detection Method Based on API-Pair Graph

Dynamic Malware Analysis Based on API Sequence Semantic Fusion

Malware Detection Based on Visualization of Recombined API Instruction Sequence.

An Android Malware Detection Method Using Deep Learning Based on API Calls

ASSCA: API Based Sequence and Statistics Features Combined Malware Detection Architecture

A Feature-Hybrid Malware Variants Detection Using CNN Based Opcode Embedding and BPNN Based API Embedding.

EarlyMalDetect: A Novel Approach for Early Windows Malware Detection Based on Sequences of API Calls

Malanalyser: An Effective and Efficient Windows Malware Detection Method Based on Api Call Sequences

Deep Android Malware Classification with API-Based Feature Graph.

Dynamic Detection of Unknown Malicious Executables Base on API Interception

APIBeh: Learning Behavior Inclination of APIs for Malware Classification

Research on Malware Detection Technology for Mobile Terminals Based on API Call Sequence