Malware detection through windows system call analysis - Equipe Cybersécurité et Cryptographie
Conference Papers Year : 2024

Malware detection through windows system call analysis

Détection de logiciels malveillants (malware) grâce à l'analyse des appels système Windows

Abstract

Detecting malware remains a significant challenge, as malware authors constantly develop new techniques to evade traditional signature-based and heuristic-based detection methods. This paper proposes a novel approach to malware detection that analyzes patterns in Windows system calls sequences to identify malicious behaviors. We use a voting classifier, a machine learning model that aggregates predictions from multiple individual models. It determines the final output based on the class that receives the highest likelihood or majority vote from the ensemble of models. We trained the model on large datasets of benign and malicious system call traces to detect anomalies indicative of malware. By focusing on system call behavior rather than static code characteristics, the approach is able to identify novel malware variants without requiring prior knowledge of their signatures. Experiments using a dataset of 42,797 API call sequences from malware samples and 1,079 sequences from benign software demonstrate that voting classifier can achieve high detectionrates while maintaining low false positive rates. This type of Machine Learning-based malware detection could be integrated into an Endpoint Detection and Response (EDR) tool to provide advanced, behavior-based malware detection capabilities.
Fichier principal
Vignette du fichier
main.pdf (343.96 Ko) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-04739413 , version 1 (16-10-2024)

Identifiers

  • HAL Id : hal-04739413 , version 1

Cite

Badis Hammi, Joel Hachem, Ali Rachini, Rida Khatoun. Malware detection through windows system call analysis. 9th International Conference On Mobile And Secure Services (MOBISECSERV), Nov 2024, Miami, United States. pp.7. ⟨hal-04739413⟩
5 View
5 Download

Share

More