Opcode와 Windows API를 사용한 멀웨어 탐지 = Malware Detection Method using Opcode and windows API Calls

다국어 초록 (Multilingual Abstract)

We proposed malware detection method, which use the feature vector that consist of Opcode(operation code) and Windows API Calls extracted from executable files. And, we implemented our feature vector and measured the performance of it by using Bernoulli Naïve Bayes and K-Nearest Neighbor classifier. In experimental result, when using the K-NN classifier with the proposed method, we obtain 95.21% malware detection accuracy. It was better than existing methods using only either Opcode or Windows API Calls.

참고문헌 (Reference)

1 권영만, "경험기법을 사용한 SNS 스팸의 클러스터링에 관한 연구" 한국인터넷방송통신학회 14 (14): 7-12, 2014

2 "virusshare"

3 "malwareblacklist"

4 "malc0de"

5 "joxeankoret"

6 Capstone, "capstone"

7 "analysis method"

8 M. Alazab, "Zero-day malware detection based on supervised learning algorithms of API call signatures" 121 : 171-182, 2011

9 G. Bala Krishna, "Review of Contemporary Literature on Machine Learning based Malware Analysis and Detection Strategies" 16 (16): 11-16, 2016

10 Seung-Won Lee, "Reversing Important Principles:Malware analyst's reversing talk" Insight 141-143, 2012

11 "Python Library, scikit-learn, Bernoulli naïve bayes"

12 E. Carrera, "Pefile"

13 Igor Santos, "Opcode sequences as representation of executables for data-mining-based unknown malware detection" Elsevier BV 231 : 64-82, 2013

14 Z. Bu, "McAfee Threats Report: Second Quarter 2012" McAfee Labs 2012

15 M. Alazab, "Malware detection based on structural and behavioural features of api calls" School of Computer and Information Science, Security Research Centre, Edith Cowan University 2010

16 Yu-Jin Shim, "Malware Detection And Classification System based on API Call Sequence" University of Hanyang 2016

17 Jeong-been Park, "Malware Classification Using Worth Opcodes" 943-945, 2014

18 B. Kolosnjaji, "Deep Learning for Classification of Malware System Call sequences" 137-149, 2016

19 Galit Shmueli, "Data Mining for Business Intelligence" E&Bplus 166-, 2006

20 Yanfang Ye, "A Survey on Malware Detection Using Data Mining Techniques" Association for Computing Machinery (ACM) 50 (50): 1-40, 2017