Malware detection through windows system call analysis - Archive ouverte HAL
Communication Dans Un Congrès Année : 2024

Malware detection through windows system call analysis

Détection de logiciels malveillants (malware) grâce à l'analyse des appels système Windows

Résumé

Detecting malware remains a significant challenge, as malware authors constantly develop new techniques to evade traditional signature-based and heuristic-based detection methods. This paper proposes a novel approach to malware detection that analyzes patterns in Windows system calls sequences to identify malicious behaviors. We use a voting classifier, a machine learning model that aggregates predictions from multiple individual models. It determines the final output based on the class that receives the highest likelihood or majority vote from the ensemble of models. We trained the model on large datasets of benign and malicious system call traces to detect anomalies indicative of malware. By focusing on system call behavior rather than static code characteristics, the approach is able to identify novel malware variants without requiring prior knowledge of their signatures. Experiments using a dataset of 42,797 API call sequences from malware samples and 1,079 sequences from benign software demonstrate that voting classifier can achieve high detectionrates while maintaining low false positive rates. This type of Machine Learning-based malware detection could be integrated into an Endpoint Detection and Response (EDR) tool to provide advanced, behavior-based malware detection capabilities.
Fichier principal
Vignette du fichier
main.pdf (343.96 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04739413 , version 1 (16-10-2024)

Identifiants

  • HAL Id : hal-04739413 , version 1

Citer

Badis Hammi, Joel Hachem, Ali Rachini, Rida Khatoun. Malware detection through windows system call analysis. 9th International Conference On Mobile And Secure Services (MOBISECSERV), Nov 2024, Miami, United States. pp.7. ⟨hal-04739413⟩
5 Consultations
5 Téléchargements

Partager

More