A Model for Malware Detection Method based on API call Sequence Clustering

Abstract

In recent years, the extensive development of malware industry has brought many threats to the development of information technology. How to effectively detect malware has attracted much attention. The sequence of API calls has been proved to be effective in malware detection. There are obvious differences between the API call sequences of malware and good software. Based on this difference, in this paper, we introduce a Windows platform malware detection method based on deep neural network, which learns the API sequences. We use word embedding to understand the context relationship between API functions in malware call sequence. At the same time, we separate single functions with similar context characteristics into groups, and then convert the API call sequence into the corresponding group sequence. Finally, the group sequence is embedded and sent into the deep neural network to train the binary classifier to detect malware.