Classification of malware families based on runtime behaviors


Pektas A., ACARMAN T.

JOURNAL OF INFORMATION SECURITY AND APPLICATIONS, cilt.37, ss.91-100, 2017 (SCI İndekslerine Giren Dergi) identifier identifier

  • Cilt numarası: 37
  • Basım Tarihi: 2017
  • Doi Numarası: 10.1016/j.jisa.2017.10.005
  • Dergi Adı: JOURNAL OF INFORMATION SECURITY AND APPLICATIONS
  • Sayfa Sayıları: ss.91-100

Özet

Classification of malware samples plays a crucial role in building and maintaining security. Design of a malware classification system capable of supporting a large set of samples and adaptable to model changes at runtime is required to identify the high number of malware variants. In this paper, file system, network, registry activities observed during the execution traces and n-gram modeling over API-call sequences are used to represent behavior based features of a malware. We present a methodology to build the feature vector by using run-time behaviors by applying online machine learning algorithms for classification of malware samples in a distributed and scalable architecture. To validate the effectiveness and scalability,we evaluate our method on 17,900 recent malign codes such as viruses, trojans, backdoors, worms. Our experimental results show that the presented malware classification's training and testing accuracy is reached at 94% and 92.5%, respectively. (C) 2017 Elsevier Ltd. All rights reserved.