Sensitive system calls based packed malware variants detection using principal component initialized MultiLayers neural networks

Cybersecurity

Kehuan Zhang¹  Qixin Wu¹  Hui Yin¹  Jixin Zhang²  Zheng Qin² 

[1] College of Computer Science and Electronic Engineering, Hunan University, Hunan, China;Department of Information Engineering, Chinese University of Hong Kong, Hong Kong, China

关键词: Malware variants;    Multi-layers neural networks;    Principal component analysis;    Sensitive system calls;    Sophisticated packers;   

DOI  :  10.1186/s42400-018-0010-y

学科分类：计算机科学（综合）

来源: Springer

【 摘 要 】

Malware detection has become mission sensitive as its threats spread from computer systems to Internet of things systems. Modern malware variants are generally equipped with sophisticated packers, which allow them bypass modern machine learning based detection systems. To detect packed malware variants, unpacking techniques and dynamic malware analysis are the two choices. However, unpacking techniques cannot always be useful since there exist some packers such as private packers which are hard to unpack. Although dynamic malware analysis can obtain the running behaviours of executables, the unpacking behaviours of packers add noisy information to the real behaviours of executables, which has a bad affect on accuracy. To overcome these challenges, in this paper, we propose a new method which first extracts a series of system calls which is sensitive to malicious behaviours, then use principal component analysis to extract features of these sensitive system calls, and finally adopt multi-layers neural networks to classify the features of malware variants and legitimate ones. Theoretical analysis and real-life experimental results show that our packed malware variants detection technique is comparable with the the state-of-art methods in terms of accuracy. Our approach can achieve more than 95.6\% of detection accuracy and 0.048 s of classification time cost.

【 授权许可】

CC BY