Dynamic Malware Analysis Based on API Sequence Semantic Fusion
Source abstract
Abstract
The existing dynamic malware detection methods based on API call sequences ignore the semantic information of functions. Simply mapping API to numerical values does not reflect whether a function has performed a query or modification operation, whether it is related to network communication, the file system, or other factors. Additionally, the detection performance is limited when the size of the API call sequence is too large. To address this issue, we propose Mal-ASSF, a novel malware detection model that fuses the semantic and sequence features of the API calls. The API2Vec embedding method is used to obtain the dimensionality reduction representation of the API function. To capture the behavioral features of sequential segments, Balts is used to extract the features. To leverage the implicit semantic information of the API functions, the operation and the type of resource operated by the API functions are extracted. These semantic and sequential features are then fused and processed by the attention-related modules. In comparison with the existing methods, Mal-ASSF boasts superior capabilities in terms of semantic representation and recognition of critical sequences within API call sequences. According to the evaluation with a dataset of malware families, the experimental results show that Mal-ASSF outperforms existing solutions by 3% to 5% in detection accuracy.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Spam and Phishing Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Cyber Science and Engineering, Southeast University, Nanjing 211189, China
Key Laboratory of Computer Network and Information Integration, Ministry of Education, Southeast University, Nanjing 211189, China
Funding
National Key Research and Development Program
References (37)
Show source-provided references
1. Ransomware threat success factors, taxonomy, and countermeasures: A survey and research directions10.1016/j.cose.2018.01.001 ↗
2. (2022, March 25). Mcafee Labs Threats Report. Available online: https://www.mcafee.com/enterprise/en-us/assets/reports/rp-threats-jun-2021.pdf.
3. (2021, June 20). VirusTotal File Statistics. Available online: https://www.virustotal.com/en/statistics.
4. A Survey on Malware Detection Using Data Mining Techniques10.1145/3073559 ↗
5. Mohanta, A., and Saldanha, A. (2020). Malware Analysis and Detection Engineering: A Comprehensive Approach to Detect and Analyze Modern Malware, Springer.10.1007/978-1-4842-6193-4 ↗
6. Aghakhani, H., Gritti, F., Mecca, F., Lindorfer, M., Ortolani, S., Balzarotti, D., Vigna, G., and Kruegel, C. (2020, January 23–26). When Malware is Packin’ Heat; Limits of Machine Learning Classifiers Based on Static Analysis Features. Proceedings of the Network and Distributed Systems Security (NDSS) Symposium 2020, San Diego, CA, USA.10.14722/ndss.2020.24310 ↗
7. Mantovani, A., Aonzo, S., Ugarte-Pedrero, X., Merlo, A., and Balzarotti, D. (2020, January 23–26). Prevalence and Impact of Low-Entropy Packing Schemes in the Malware Ecosystem. Proceedings of the NDSS, San Diego, CA, USA.10.14722/ndss.2020.24297 ↗
8. Sahay, S.K., Sharma, A., and Rathore, H. (2020, January 27–28). Evolution of Malware and Its Detection Techniques. Proceedings of the Information and Communication Technology for Sustainable Development, New Delhi, India.
9. On building machine learning pipelines for Android malware detection: A procedural survey of practices, challenges and opportunities10.1186/s42400-022-00119-8 ↗
10. A cost analysis of machine learning using dynamic runtime opcodes for malware detection10.1016/j.cose.2019.04.018 ↗
11. An Advanced Computing Approach for IoT-Botnet Detection in Industrial Internet of Things10.1109/TII.2022.3152814 ↗
12. Rosenberg, I., Shabtai, A., Rokach, L., and Elovici, Y. (2018, January 10–12). Generic Black-Box End-to-End Attack Against State of the Art API Call Based Malware Classifiers. Proceedings of the Research in Attacks, Intrusions, and Defenses, Crete, Greece.10.1007/978-3-030-00470-5_23 ↗
13. Efficient and Robust Malware Detection Based on Control Flow Traces Using Deep Neural Networks10.1016/j.cose.2022.102871 ↗
14. Rosenberg, I., Shabtai, A., Elovici, Y., and Rokach, L. (2020, January 7–11). Query-Efficient Black-Box Attack Against Sequence-Based Malware Classifiers. Proceedings of the Annual Computer Security Applications Conference, Austin, TX, USA.10.1145/3427228.3427230 ↗
15. Huang, W., and Stokes, J.W. (2016, January 7–8). MtNet: A Multi-Task Neural Network for Dynamic Malware Classification. Proceedings of the Detection of Intrusions and Malware, and Vulnerability Assessment, San Sebastián, Spain.10.1007/978-3-319-40667-1_20 ↗
16. Malicious code classification based on opcode sequences and textCNN network
17. Long short-term memory-based Malware classification method for information security10.1016/j.compeleceng.2019.06.014 ↗
18. Classification of malware families based on runtime behaviors
19. Sub-curve HMM: A malware detection approach based on partial analysis of API call sequences10.1016/j.cose.2020.101773 ↗
20. Analysis of Networks and Digital Systems by Using the Novel Technique Based on Complex Fuzzy Soft Information10.1109/TCE.2022.3226819 ↗
21. Android Malware Familial Classification and Representative Sample Selection via Frequent Subgraph Analysis10.1109/TIFS.2018.2806891 ↗
22. Detection of malicious software by analyzing the behavioral artifacts using machine learning algorithms10.1016/j.infsof.2020.106273 ↗
23. AlAhmadi, B.A., and Martinovic, I. (2018, January 15–17). MalClassifier: Malware family classification using network flow sequence behaviour. Proceedings of the 2018 APWG Symposium on Electronic Crime Research (eCrime), San Diego, CA, USA.10.1109/ECRIME.2018.8376209 ↗
24. Detection of Malicious Code Variants Based on Deep Learning10.1109/TII.2018.2822680 ↗
25. Deep Learning Approach for Intelligent Intrusion Detection System10.1109/ACCESS.2019.2895334 ↗
26. Recurrent neural network for detecting malware10.1016/j.cose.2020.102037 ↗
27. Deep learning based Sequential model for malware analysis using Windows exe API Calls10.7717/peerj-cs.285 ↗
28. DL-FHMC: Deep Learning-Based Fine-Grained Hierarchical Learning Approach for Robust Malware Classification10.1109/TDSC.2021.3097296 ↗
29. A dynamic Windows malware detection and prediction method based on contextual understanding of API call sequence10.1016/j.cose.2020.101760 ↗
30. Dynamic Malware Analysis with Feature Engineering and Feature Learning
31. Daeef, A.Y., Al-Naji, A., Nahar, A.K., and Chahl, J. (2023). Features Engineering to Differentiate between Malware and Legitimate Software. Appl. Sci., 13.10.3390/app13031972 ↗
32. CruParamer: Learning on Parameter-Augmented API Sequences for Malware Detection10.1109/TIFS.2022.3152360 ↗
33. DMalNet: Dynamic malware analysis based on API feature engineering and graph learning10.1016/j.cose.2022.102872 ↗
34. Balan, G., GavriluŢ, D.T., and Luchian, H. (2022, January 23–25). Using API Calls for Sequence-Pattern Feature Mining-Based Malware Detection. Proceedings of the Information Security Practice and Experience, Taipei, Taiwan.10.1007/978-3-031-21280-2_13 ↗
35. MalSPM: Metamorphic malware behavior analysis and classification using sequential pattern mining10.1016/j.cose.2022.102741 ↗
36. Agrawal, R., Stokes, J.W., Marinescu, M., and Selvaraj, K. (2018, January 15–20). Neural Sequential Malware Detection with Parameters. Proceedings of the 2018 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Calgary, AB, Canada.10.1109/ICASSP.2018.8461583 ↗
37. (2021, June 20). Alibaba Cloud Malware Detection Based on Behaviors. Available online: https://tianchi.aliyun.com/competition/entrance/231694/information.