MALWARE DETECTION BASED ON STRUCTURAL AND BEHAVIOURAL FEATURES OF API CALLS

by Mamoun Alazab , Robert Layton , Sitalakshmi Venkataraman , Paul Watters

Datum	Value	Source
TITLE	MALWARE DETECTION BASED ON STRUCTURAL AND BEHAVIOURAL FEATURES OF API CALLS	SVM HeaderParse 0.2
AUTHOR NAME	Mamoun Alazab	SVM HeaderParse 0.2
AUTHOR AFFIL	ITMS; University of Ballarat	SVM HeaderParse 0.2
AUTHOR NAME	Robert Layton	SVM HeaderParse 0.2
AUTHOR NAME	Sitalakshmi Venkataraman	SVM HeaderParse 0.2
AUTHOR NAME	Paul Watters	SVM HeaderParse 0.2
AUTHOR AFFIL	ITMS; University of Ballarat	SVM HeaderParse 0.2
ABSTRACT	In this paper, we propose a five-step approach to detect obfuscated malware by investigating the structural and behavioural features of API calls. We have developed a fully automated system to disassemble and extract API call features effectively from executables. Using n-gram statistical analysis of binary content, we are able to classify if an executable file is malicious or benign. Our experimental results with a dataset of 242 malwares and 72 benign files have shown a promising accuracy of 96.5 % for the unigram model. We also provide a preliminary analysis by our approach using support vector machine (SVM) and by varying n-values from 1 to 5, we have analysed the performance that include accuracy, false positives and false negatives. By applying SVM, we propose to train the classifier and derive an optimum n-gram model for detecting both known and unknown malware efficiently. Keywords: Code obfuscation, Feature extraction, Malware, n-gram, SVM.	SVM HeaderParse 0.2
CITATIONS	38 found	ParsCit 1.0