Detecting Malware Activities With MalpMiner: A Dynamic Analysis Approach

Abstract

Day by day, malware as a service becomes more popular and easy to acquire, thus allowing anyone to start an attack without any technical background. In addition, advanced malware attacks get more sophisticated such as Advanced Persistent Threats (APTs). Such reasons introduce challenges for detecting such attacks. One of those challenges is the detection of malware activities early in order to prevent harm as much as possible. Therefore, this paper presents a trusted dynamic analysis approach based on Answer Set Programming (ASP), a logic engine inference named Malware-Logic-Miner (MalpMiner). ASP is a nonmonotonic reasoning engine built on an open-world assumption. Thus, it allows MalpMiner to adopt commonsense reasoning when capturing malware activities of any given binary. Furthermore, MalpMiner requires no prior training; therefore, it can scale up quickly to include more malware-attack attributes. Besides that, it considers the invoked application programming interfaces’ values, resulting in correct malware behaviour modelling. The baseline experiments prove the correctness of MalpMiner related to recognizing malware activities. Moreover, MalpMiner achieved a detection ratio of 99% with a false-positive rate of less than 1% while maintaining low computational costs and explaining the detection decision.