Cross-Method-Based Analysis and Classification of Malicious Behavior by API Calls Extraction

Bruce Ndibanje,Young Kang,Tae Kim,Hyun Kim,Ki Kim,Hoon Lee

doi:10.3390/app9020239

Abstract

Data-driven public security networking and computer systems are always under threat from malicious codes known as malware; therefore, a large amount of research and development is taking place to find effective countermeasures. These countermeasures are mainly based on dynamic and statistical analysis. Because of the obfuscation techniques used by the malware authors, security researchers and the anti-virus industry are facing a colossal issue regarding the extraction of hidden payloads within packed executable extraction. Based on this understanding, we first propose a method to de-obfuscate and unpack the malware samples. Additional, cross-method-based big data analysis to dynamically and statistically extract features from malware has been proposed. The Application Programming Interface (API) call sequences that reflect the malware behavior of its code have been used to detect behavior such as network traffic, modifying a file, writing to stderr or stdout, modifying a registry value, creating a process. Furthermore, we include a similarity analysis and machine learning algorithms to profile and classify malware behaviors. The experimental results of the proposed method show that malware detection accuracy is very useful to discover potential threats and can help the decision-maker to deploy appropriate countermeasures.

Highlights

Cybersecurity threats are growing and rapidly adapt to new opportunities in cyberspace
We describe the method used for malware classification based on Application Programming Interface (API) call lists made from dynamic and static analysis, as shown in Figure 1, where the dash arrow line gives the direction to the data as input into Cuckoo S-Box and the thin and thick arrows lines show different directions from a given component to another
We showed that malware detection is possible using static and dynamic methods

Summary

Introduction

Cybersecurity threats are growing and rapidly adapt to new opportunities in cyberspace. The inter-connectivity of devices and services via high internet speeds make it easy for cybercriminals to operate remotely from overseas and remain unidentified online. In this context, it is, challenging to identify and trace the malware origin of such crime. Malware [2], known as “malicious software”, is a software created by an attacker to compromise the security of a system or privacy of a victim. The quantity and types of malware [3] have increased, and they are challenging cybersecurity experts, law, and forensics examiners [4,5,6,7].

Methods

Results

Conclusion