A Shellcode Detection Method Based on Full Native API Sequence and Support Vector Machine

2017 3rd International Conference on Applied Materials and Manufacturing Technology

Cheng, Yixuan^1 ; Fan, Wenqing^1 ; Huang, Wei^1 ; An, Jing^1

A College of Computer, Communication University of China, Beijing

100024, China^1

关键词: API calls;    Detection rates;    Dynamic characteristics;    Dynamic monitoring;    High-accuracy;    Sequence features;    Shellcode;    Shellcode detections;   

Others  :  https://iopscience.iop.org/article/10.1088/1757-899X/242/1/012124/pdf
DOI  :  10.1088/1757-899X/242/1/012124

来源: IOP

【 摘 要 】

Dynamic monitoring the behavior of a program is widely used to discriminate between benign program and malware. It is usually based on the dynamic characteristics of a program, such as API call sequence or API call frequency to judge. The key innovation of this paper is to consider the full Native API sequence and use the support vector machine to detect the shellcode. We also use the Markov chain to extract and digitize Native API sequence features. Our experimental results show that the method proposed in this paper has high accuracy and low detection rate.