Cargando…
Deep learning based Sequential model for malware analysis using Windows exe API Calls
Malware development has seen diversity in terms of architecture and features. This advancement in the competencies of malware poses a severe threat and opens new research dimensions in malware detection. This study is focused on metamorphic malware, which is the most advanced member of the malware f...
Autores principales: | , , , |
---|---|
Formato: | Online Artículo Texto |
Lenguaje: | English |
Publicado: |
PeerJ Inc.
2020
|
Materias: | |
Acceso en línea: | https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7924690/ https://www.ncbi.nlm.nih.gov/pubmed/33816936 http://dx.doi.org/10.7717/peerj-cs.285 |
_version_ | 1783659142183911424 |
---|---|
author | Catak, Ferhat Ozgur Yazı, Ahmet Faruk Elezaj, Ogerta Ahmed, Javed |
author_facet | Catak, Ferhat Ozgur Yazı, Ahmet Faruk Elezaj, Ogerta Ahmed, Javed |
author_sort | Catak, Ferhat Ozgur |
collection | PubMed |
description | Malware development has seen diversity in terms of architecture and features. This advancement in the competencies of malware poses a severe threat and opens new research dimensions in malware detection. This study is focused on metamorphic malware, which is the most advanced member of the malware family. It is quite impossible for anti-virus applications using traditional signature-based methods to detect metamorphic malware, which makes it difficult to classify this type of malware accordingly. Recent research literature about malware detection and classification discusses this issue related to malware behavior. The main goal of this paper is to develop a classification method according to malware types by taking into consideration the behavior of malware. We started this research by developing a new dataset containing API calls made on the windows operating system, which represents the behavior of malicious software. The types of malicious malware included in the dataset are Adware, Backdoor, Downloader, Dropper, spyware, Trojan, Virus, and Worm. The classification method used in this study is LSTM (Long Short-Term Memory), which is a widely used classification method in sequential data. The results obtained by the classifier demonstrate accuracy up to 95% with 0.83 $F_1$-score, which is quite satisfactory. We also run our experiments with binary and multi-class malware datasets to show the classification performance of the LSTM model. Another significant contribution of this research paper is the development of a new dataset for Windows operating systems based on API calls. To the best of our knowledge, there is no such dataset available before our research. The availability of our dataset on GitHub facilitates the research community in the domain of malware detection to benefit and make a further contribution to this domain. |
format | Online Article Text |
id | pubmed-7924690 |
institution | National Center for Biotechnology Information |
language | English |
publishDate | 2020 |
publisher | PeerJ Inc. |
record_format | MEDLINE/PubMed |
spelling | pubmed-79246902021-04-02 Deep learning based Sequential model for malware analysis using Windows exe API Calls Catak, Ferhat Ozgur Yazı, Ahmet Faruk Elezaj, Ogerta Ahmed, Javed PeerJ Comput Sci Artificial Intelligence Malware development has seen diversity in terms of architecture and features. This advancement in the competencies of malware poses a severe threat and opens new research dimensions in malware detection. This study is focused on metamorphic malware, which is the most advanced member of the malware family. It is quite impossible for anti-virus applications using traditional signature-based methods to detect metamorphic malware, which makes it difficult to classify this type of malware accordingly. Recent research literature about malware detection and classification discusses this issue related to malware behavior. The main goal of this paper is to develop a classification method according to malware types by taking into consideration the behavior of malware. We started this research by developing a new dataset containing API calls made on the windows operating system, which represents the behavior of malicious software. The types of malicious malware included in the dataset are Adware, Backdoor, Downloader, Dropper, spyware, Trojan, Virus, and Worm. The classification method used in this study is LSTM (Long Short-Term Memory), which is a widely used classification method in sequential data. The results obtained by the classifier demonstrate accuracy up to 95% with 0.83 $F_1$-score, which is quite satisfactory. We also run our experiments with binary and multi-class malware datasets to show the classification performance of the LSTM model. Another significant contribution of this research paper is the development of a new dataset for Windows operating systems based on API calls. To the best of our knowledge, there is no such dataset available before our research. The availability of our dataset on GitHub facilitates the research community in the domain of malware detection to benefit and make a further contribution to this domain. PeerJ Inc. 2020-07-27 /pmc/articles/PMC7924690/ /pubmed/33816936 http://dx.doi.org/10.7717/peerj-cs.285 Text en ©2020 Catak et al. https://creativecommons.org/licenses/by/4.0/ This is an open access article distributed under the terms of the Creative Commons Attribution License (https://creativecommons.org/licenses/by/4.0/) , which permits unrestricted use, distribution, reproduction and adaptation in any medium and for any purpose provided that it is properly attributed. For attribution, the original author(s), title, publication source (PeerJ Computer Science) and either DOI or URL of the article must be cited. |
spellingShingle | Artificial Intelligence Catak, Ferhat Ozgur Yazı, Ahmet Faruk Elezaj, Ogerta Ahmed, Javed Deep learning based Sequential model for malware analysis using Windows exe API Calls |
title | Deep learning based Sequential model for malware analysis using Windows exe API Calls |
title_full | Deep learning based Sequential model for malware analysis using Windows exe API Calls |
title_fullStr | Deep learning based Sequential model for malware analysis using Windows exe API Calls |
title_full_unstemmed | Deep learning based Sequential model for malware analysis using Windows exe API Calls |
title_short | Deep learning based Sequential model for malware analysis using Windows exe API Calls |
title_sort | deep learning based sequential model for malware analysis using windows exe api calls |
topic | Artificial Intelligence |
url | https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7924690/ https://www.ncbi.nlm.nih.gov/pubmed/33816936 http://dx.doi.org/10.7717/peerj-cs.285 |
work_keys_str_mv | AT catakferhatozgur deeplearningbasedsequentialmodelformalwareanalysisusingwindowsexeapicalls AT yazıahmetfaruk deeplearningbasedsequentialmodelformalwareanalysisusingwindowsexeapicalls AT elezajogerta deeplearningbasedsequentialmodelformalwareanalysisusingwindowsexeapicalls AT ahmedjaved deeplearningbasedsequentialmodelformalwareanalysisusingwindowsexeapicalls |