Improved N-gram Algorithm for Unknown Malware Detection

Abstract

Malware is a major cybersecurity threat, which can affect your information system. with the tremendous proliferation of unknown malware, the traditional malware detection extracting feature codes by reverse analysis cannot handle this unknown malware effectively. In this paper, an improved N-gram algorithm is proposed to construct semantic relationships between assembly codes extracted from malware samples. We extract the disassembly codes from the binary executable file, and then convert the feature codes into a feature vector that can be imported into the machine learning model. Finally, we evaluate the proposed algorithm with the evaluation index of machine learning such as detection rate, false alarm rate, benchmark rate, and accuracy of malware detection. The experimental results show that the proposed improved N-gram algorithm has improved the accuracy and efficiency of unknown malware detection. (Abstract)