Deep learning based Sequential model for malware analysis using Windows exe API Calls

被引:87
作者
Catak, Ferhat Ozgur [1 ,3 ]
Yaz, Ahmet Faruk [2 ]
Elezaj, Ogerta [1 ]
Ahmed, Javed [1 ]
机构
[1] NTNU Norwegian Univ Sci & Technol, Dept Informat Secur & Commun Technol, Gjovik, Norway
[2] Istanbul Sehir Univ, Cyber Secur Engn, Istanbul, Turkey
[3] TUBITAK Bilgem Cyber Secur Inst, Kocaeli, Turkey
关键词
Malware analysis; Sequential models; Network security; Long-short-term memory; Malware dataset;
D O I
10.7717/peerj-cs.285
中图分类号
TP18 [人工智能理论];
学科分类号
081104 ; 0812 ; 0835 ; 1405 ;
摘要
Malware development has seen diversity in terms of architecture and features. This advancement in the competencies of malware poses a severe threat and opens new research dimensions in malware detection. This study is focused on metamorphic malware, which is the most advanced member of the malware family. It is quite impossible for anti-virus applications using traditional signature-based methods to detect metamorphic malware, which makes it difficult to classify this type of malware accordingly. Recent research literature about malware detection and classification discusses this issue related to malware behavior. The main goal of this paper is to develop a classification method according to malware types by taking into consideration the behavior of malware. We started this research by developing a new dataset containing API calls made on the windows operating system, which represents the behavior of malicious software. The types of malicious malware included in the dataset are Adware, Backdoor, Downloader, Dropper, spyware, Trojan, Virus, and Worm. The classification method used in this study is LSTM (Long Short-Term Memory), which is a widely used classification method in sequential data. The results obtained by the classifier demonstrate accuracy up to 95% with 0.83 $F_1$-score, which is quite satisfactory. We also run our experiments with binary and multi-class malware datasets to show the classification performance of the LSTM model. Another significant contribution of this research paper is the development of a new dataset for Windows operating systems based on API calls. To the best of our knowledge, there is no such dataset available before our research. The availability of our dataset on GitHub facilitates the research community in the domain of malware detection to benefit and make a further contribution to this domain.
引用
收藏
页数:23
相关论文
共 27 条
[1]  
Ahmed ME, 2018, IEEE 4 INT C COLL IN
[2]  
Alazab M., 2010, Proceedings Second Cybercrime and Trustworthy Computing Workshop (CTC 2010), P52, DOI 10.1109/CTC.2010.8
[3]  
Alazab M, 2010, 2010 1 INT CYB RES C
[4]   A proactive malicious software identification approach for digital forensic examiners [J].
Ali, Muhammad ;
Shiaeles, Stavros ;
Clarke, Nathan ;
Kontogeorgis, Dimitrios .
JOURNAL OF INFORMATION SECURITY AND APPLICATIONS, 2019, 47 :139-155
[5]  
[Anonymous], 2009, INT C MAL UNW SOFTW
[6]  
CATAK FO, 2019, ARXIV190501999
[7]  
Cheng JYC, 2013, INT CONF MACH LEARN, P1678, DOI 10.1109/ICMLC.2013.6890868
[8]   Ransomware behavioural analysis on windows platforms [J].
Hampton, Nikolai ;
Baig, Zubair ;
Zeadally, Sherali .
JOURNAL OF INFORMATION SECURITY AND APPLICATIONS, 2018, 40 :44-51
[9]  
Hochreiter S, 1997, NEURAL COMPUT, V9, P1735, DOI [10.1162/neco.1997.9.8.1735, 10.1162/neco.1997.9.1.1, 10.1007/978-3-642-24797-2]
[10]  
Kolosnjaji Bojan, 2016, AI 2016: Advances in Artificial Intelligence. 29th Australasian Joint Conference. Proceedings: LNAI 9992, P137, DOI 10.1007/978-3-319-50127-7_11