Cargando…

Deep learning based Sequential model for malware analysis using Windows exe API Calls

Malware development has seen diversity in terms of architecture and features. This advancement in the competencies of malware poses a severe threat and opens new research dimensions in malware detection. This study is focused on metamorphic malware, which is the most advanced member of the malware f...

Descripción completa

Detalles Bibliográficos
Autores principales: Catak, Ferhat Ozgur, Yazı, Ahmet Faruk, Elezaj, Ogerta, Ahmed, Javed
Formato: Online Artículo Texto
Lenguaje:English
Publicado: PeerJ Inc. 2020
Materias:
Acceso en línea:https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7924690/
https://www.ncbi.nlm.nih.gov/pubmed/33816936
http://dx.doi.org/10.7717/peerj-cs.285
_version_ 1783659142183911424
author Catak, Ferhat Ozgur
Yazı, Ahmet Faruk
Elezaj, Ogerta
Ahmed, Javed
author_facet Catak, Ferhat Ozgur
Yazı, Ahmet Faruk
Elezaj, Ogerta
Ahmed, Javed
author_sort Catak, Ferhat Ozgur
collection PubMed
description Malware development has seen diversity in terms of architecture and features. This advancement in the competencies of malware poses a severe threat and opens new research dimensions in malware detection. This study is focused on metamorphic malware, which is the most advanced member of the malware family. It is quite impossible for anti-virus applications using traditional signature-based methods to detect metamorphic malware, which makes it difficult to classify this type of malware accordingly. Recent research literature about malware detection and classification discusses this issue related to malware behavior. The main goal of this paper is to develop a classification method according to malware types by taking into consideration the behavior of malware. We started this research by developing a new dataset containing API calls made on the windows operating system, which represents the behavior of malicious software. The types of malicious malware included in the dataset are Adware, Backdoor, Downloader, Dropper, spyware, Trojan, Virus, and Worm. The classification method used in this study is LSTM (Long Short-Term Memory), which is a widely used classification method in sequential data. The results obtained by the classifier demonstrate accuracy up to 95% with 0.83 $F_1$-score, which is quite satisfactory. We also run our experiments with binary and multi-class malware datasets to show the classification performance of the LSTM model. Another significant contribution of this research paper is the development of a new dataset for Windows operating systems based on API calls. To the best of our knowledge, there is no such dataset available before our research. The availability of our dataset on GitHub facilitates the research community in the domain of malware detection to benefit and make a further contribution to this domain.
format Online
Article
Text
id pubmed-7924690
institution National Center for Biotechnology Information
language English
publishDate 2020
publisher PeerJ Inc.
record_format MEDLINE/PubMed
spelling pubmed-79246902021-04-02 Deep learning based Sequential model for malware analysis using Windows exe API Calls Catak, Ferhat Ozgur Yazı, Ahmet Faruk Elezaj, Ogerta Ahmed, Javed PeerJ Comput Sci Artificial Intelligence Malware development has seen diversity in terms of architecture and features. This advancement in the competencies of malware poses a severe threat and opens new research dimensions in malware detection. This study is focused on metamorphic malware, which is the most advanced member of the malware family. It is quite impossible for anti-virus applications using traditional signature-based methods to detect metamorphic malware, which makes it difficult to classify this type of malware accordingly. Recent research literature about malware detection and classification discusses this issue related to malware behavior. The main goal of this paper is to develop a classification method according to malware types by taking into consideration the behavior of malware. We started this research by developing a new dataset containing API calls made on the windows operating system, which represents the behavior of malicious software. The types of malicious malware included in the dataset are Adware, Backdoor, Downloader, Dropper, spyware, Trojan, Virus, and Worm. The classification method used in this study is LSTM (Long Short-Term Memory), which is a widely used classification method in sequential data. The results obtained by the classifier demonstrate accuracy up to 95% with 0.83 $F_1$-score, which is quite satisfactory. We also run our experiments with binary and multi-class malware datasets to show the classification performance of the LSTM model. Another significant contribution of this research paper is the development of a new dataset for Windows operating systems based on API calls. To the best of our knowledge, there is no such dataset available before our research. The availability of our dataset on GitHub facilitates the research community in the domain of malware detection to benefit and make a further contribution to this domain. PeerJ Inc. 2020-07-27 /pmc/articles/PMC7924690/ /pubmed/33816936 http://dx.doi.org/10.7717/peerj-cs.285 Text en ©2020 Catak et al. https://creativecommons.org/licenses/by/4.0/ This is an open access article distributed under the terms of the Creative Commons Attribution License (https://creativecommons.org/licenses/by/4.0/) , which permits unrestricted use, distribution, reproduction and adaptation in any medium and for any purpose provided that it is properly attributed. For attribution, the original author(s), title, publication source (PeerJ Computer Science) and either DOI or URL of the article must be cited.
spellingShingle Artificial Intelligence
Catak, Ferhat Ozgur
Yazı, Ahmet Faruk
Elezaj, Ogerta
Ahmed, Javed
Deep learning based Sequential model for malware analysis using Windows exe API Calls
title Deep learning based Sequential model for malware analysis using Windows exe API Calls
title_full Deep learning based Sequential model for malware analysis using Windows exe API Calls
title_fullStr Deep learning based Sequential model for malware analysis using Windows exe API Calls
title_full_unstemmed Deep learning based Sequential model for malware analysis using Windows exe API Calls
title_short Deep learning based Sequential model for malware analysis using Windows exe API Calls
title_sort deep learning based sequential model for malware analysis using windows exe api calls
topic Artificial Intelligence
url https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7924690/
https://www.ncbi.nlm.nih.gov/pubmed/33816936
http://dx.doi.org/10.7717/peerj-cs.285
work_keys_str_mv AT catakferhatozgur deeplearningbasedsequentialmodelformalwareanalysisusingwindowsexeapicalls
AT yazıahmetfaruk deeplearningbasedsequentialmodelformalwareanalysisusingwindowsexeapicalls
AT elezajogerta deeplearningbasedsequentialmodelformalwareanalysisusingwindowsexeapicalls
AT ahmedjaved deeplearningbasedsequentialmodelformalwareanalysisusingwindowsexeapicalls