Classification of malware families based on runtime behaviors

Pektas A., ACARMAN T.

JOURNAL OF INFORMATION SECURITY AND APPLICATIONS, vol.37, pp.91-100, 2017 (SCI-Expanded) identifier identifier

  • Publication Type: Article / Article
  • Volume: 37
  • Publication Date: 2017
  • Doi Number: 10.1016/j.jisa.2017.10.005
  • Journal Name: JOURNAL OF INFORMATION SECURITY AND APPLICATIONS
  • Journal Indexes: Science Citation Index Expanded (SCI-EXPANDED), Scopus
  • Page Numbers: pp.91-100
  • Keywords: Behavior analysis, Dynamic analysis, Malware classification, Machine learning
  • Galatasaray University Affiliated: Yes

Abstract

Classification of malware samples plays a crucial role in building and maintaining security. Design of a malware classification system capable of supporting a large set of samples and adaptable to model changes at runtime is required to identify the high number of malware variants. In this paper, file system, network, registry activities observed during the execution traces and n-gram modeling over API-call sequences are used to represent behavior based features of a malware. We present a methodology to build the feature vector by using run-time behaviors by applying online machine learning algorithms for classification of malware samples in a distributed and scalable architecture. To validate the effectiveness and scalability,we evaluate our method on 17,900 recent malign codes such as viruses, trojans, backdoors, worms. Our experimental results show that the presented malware classification's training and testing accuracy is reached at 94% and 92.5%, respectively. (C) 2017 Elsevier Ltd. All rights reserved.