In order to solve the problem that traditional signature-based malware detection systems are inefficacious in detecting new malware,a practical malware detection system is constructed to find out new malware. Applicat...In order to solve the problem that traditional signature-based malware detection systems are inefficacious in detecting new malware,a practical malware detection system is constructed to find out new malware. Application programming interface( API) call sequence is introduced to capture activities of a program in this system. After that,based on variable-length n-gram,API call order can be extracted from API call sequence as the malicious behavior feature of a software. Compared with traditional methods,which use fixed-length n-gram,the solution can find more new malware. The experimental results show that the presented approach improves the accuracy of malware detection.展开更多
基金Supported by the National High Technology Research and Development Programme of China(No.2013AA014702)the Fundamental Research Funds for the Central University(No.2014PTB-00-04)the China Next Generation Internet Project(No.CNGI-12-02-027)
文摘In order to solve the problem that traditional signature-based malware detection systems are inefficacious in detecting new malware,a practical malware detection system is constructed to find out new malware. Application programming interface( API) call sequence is introduced to capture activities of a program in this system. After that,based on variable-length n-gram,API call order can be extracted from API call sequence as the malicious behavior feature of a software. Compared with traditional methods,which use fixed-length n-gram,the solution can find more new malware. The experimental results show that the presented approach improves the accuracy of malware detection.
