Using feature generation from API calls for malware detection

Abstract

The term malware – a combination of the words ‘malicious’ and ‘software’ – refers to a group of software designed to penetrate or damage a computer system without the owner's permission. This set includes viruses, trojans, backdoors, worms, adware, rootkits, spyware and so on. Methods for detecting malicious software, based on signatures, are easily evaded, so anti-virus vendors rely on dynamic analysis to detect zero-day binaries. Unfortunately, this is too slow and inefficient to be used in commercial anti-virus. Zahra Salehi, Ashkan Sami and Mahboobe Ghiasi of Shiraz University, Iran, propose a new malware detection technique based on identifying malicious behaviour through API calls and/or arguments. The high accuracy and low false positives of the method demonstrate that it is appropriate for real-world commercial applications, they argue.