Malware Detection based on Graph Classification

Khanh-Huu-The Dam, Tayssir Touili

2017

Abstract

Malware detection is nowadays a big challenge. The existing techniques for malware detection require a huge effort of engineering to manually extract the malicious behaviors. To avoid this tedious task of manually discovering malicious behaviors, we propose in this paper to apply learning for malware detection. Given a set of malwares and a set of benign programs, we show how learning techniques can be applied in order to detect malware. For that, we use abstract API graphs to represent programs. Abstract API graphs are graphs whose nodes are API functions and whose edges represent the order of execution of the different calls to the API functions (i.e., functions supported by the operating system). To learn malware, we apply well-known learning techniques based on Random Walk Graph Kernel (combined with Support Vector Machines). We can achieve a high detection rate with only few false alarms (98.93% for detection rate with 1.24% of false alarms). Moreover, we show that our techniques are able to detect several malwares that could not be detected by well-known and widely used antiviruses such as Avira, Kaspersky, Avast, Qihoo-360, McAfee, AVG, BitDefender, ESET-NOD32, F-Secure, Symantec or Panda.

Paper Citation

in Harvard Style

Dam K. and Touili T. (2017). Malware Detection based on Graph Classification . In Proceedings of the 3rd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-209-7, pages 455-463. DOI: 10.5220/0006209504550463

in Bibtex Style

@conference{icissp17,
author={Khanh-Huu-The Dam and Tayssir Touili},
title={Malware Detection based on Graph Classification},
booktitle={Proceedings of the 3rd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},
year={2017},
pages={455-463},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0006209504550463},
isbn={978-989-758-209-7},
}

in EndNote Style

TY - CONF
JO - Proceedings of the 3rd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - Malware Detection based on Graph Classification
SN - 978-989-758-209-7
AU - Dam K.
AU - Touili T.
PY - 2017
SP - 455
EP - 463
DO - 10.5220/0006209504550463