Malware Detection Using Dynamic Birthmarks

2019/01/06 by Swapna Vemparala, Fabio Di Troia, Vemparala, Swapna +8
Computer Science · Mathematics · #Advanced Malware Detection Techniques #Anomaly Detection Techniques and Applications #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML) #Network Security and Intrusion Detection #cs.CR #cs.LG #stat.ML

paper · pdf · doi:10.48550/arxiv.1901.07312

Extended version of conference paper

arxiv created 2019/01/06 · openalex publication_date 2019/01/06 · arxiv updated 2019/01/23 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

In this paper, we explore the effectiveness of dynamic analysis techniques for identifying malware, using Hidden Markov Models (HMMs) and Profile Hidden Markov Models (PHMMs), both trained on sequences of API calls. We contrast our results to static analysis using HMMs trained on sequences of opcodes, and show that dynamic analysis achieves significantly stronger results in many cases. Furthermore, in contrasting our two dynamic analysis techniques, we find that using PHMMs consistently outperforms our analysis based on HMMs.

Related

• Machine Learning for Malware Evolution Detection
• Hidden Markov Models with Random Restarts vs Boosting for Malware Detection
• A Natural Language Processing Approach to Malware Classification
• NtMalDetect: A Machine Learning Approach to Malware Detection Using Native API System Calls
• IMCDCF: An Incremental Malware Detection Approach Using Hidden Markov Models