Classification of malware families based on runtime behaviors

Pektas A., ACARMAN T.

JOURNAL OF INFORMATION SECURITY AND APPLICATIONS, cilt.37, ss.91-100, 2017 (SCI-Expanded) identifier identifier

  • Yayın Türü: Makale / Tam Makale
  • Cilt numarası: 37
  • Basım Tarihi: 2017
  • Doi Numarası: 10.1016/j.jisa.2017.10.005
  • Dergi Adı: JOURNAL OF INFORMATION SECURITY AND APPLICATIONS
  • Derginin Tarandığı İndeksler: Science Citation Index Expanded (SCI-EXPANDED), Scopus
  • Sayfa Sayıları: ss.91-100
  • Anahtar Kelimeler: Behavior analysis, Dynamic analysis, Malware classification, Machine learning
  • Galatasaray Üniversitesi Adresli: Evet

Özet

Classification of malware samples plays a crucial role in building and maintaining security. Design of a malware classification system capable of supporting a large set of samples and adaptable to model changes at runtime is required to identify the high number of malware variants. In this paper, file system, network, registry activities observed during the execution traces and n-gram modeling over API-call sequences are used to represent behavior based features of a malware. We present a methodology to build the feature vector by using run-time behaviors by applying online machine learning algorithms for classification of malware samples in a distributed and scalable architecture. To validate the effectiveness and scalability,we evaluate our method on 17,900 recent malign codes such as viruses, trojans, backdoors, worms. Our experimental results show that the presented malware classification's training and testing accuracy is reached at 94% and 92.5%, respectively. (C) 2017 Elsevier Ltd. All rights reserved.