Malware detection based on hybrid signature behavior application programming interface call graph

• Main Authors: Elhadi, Ammar Ahmed E., Maarof, Mohd Aizaini, Osman, Ahmed Hamza
• Format: Article
• Published: Science Publications 2012
• Subjects: Q Science
• Online Access: http://eprints.utm.my/id/eprint/47170/; http://dx.doi.org/10.3844/ajassp.2012.283.288
• Institution: Universiti Teknologi Malaysia

Problem statement: A malware is a program that has malicious intent. Nowadays, malware authors apply several sophisticated techniques such as packing and obfuscation to avoid malware detection. That makes zero-day attacks and false positives the most challenging problems in the malware detection field. Approach: In this study, the static and dynamic analysis techniques that are used in malware detection are surveyed. Static analysis techniques, dynamic analysis techniques and their combination including Signature-Based and Behaviour-Based techniques are discussed. Results: In addition, a new malware detection framework is proposed. Conclusion: The proposed framework combines Signature-Based with Behaviour-Based using API graph system. The goal of the proposed framework is to improve accuracy and scan process time for malware detection.