Clasificación de Malware mediante Redes Neuronales Artificiales

Abstract

At present, any antivirus has a fully effective detection and classification mechanism to detect the thousands of virus and malware that are generated daily. Furthermore, it is known that most of these samples are variations of known malicious programs and hence have structural similarities. In this regard, to solve this problem, several classification methods to detect new malware or variants thereof are needed. This research presents a method for detecting malware based on the number of times the program calls different functions of each dynamic link library (DLL). Once the feature vector of each program is computed, an artificial neural network is trained to classify variants of malware. To validate the performance of the proposed methodology a database containing current and real samples of worms and Trojans is used.