2019/06/10 by Renjie Lu, Lu, Renjie
Computer Science · #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Network Security and Intrusion Detection #Software System Performance and Reliability #Software Testing and Debugging Techniques
paper · pdf · doi:10.48550/arxiv.1906.04632
openalex publication_date 2019/06/10 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Recently, with the booming development of software industry, more and more\nmalware variants are designed to perform malicious behaviors. The evolution of\nmalware makes it difficult to detect using traditional signature-based methods.\nMoreover, malware detection has important effect on system security. In this\npaper, we present SCGDet, which is a novel malware detection method based on\nsystem call graph model (SCGM). We first develop a system call pruning method,\nwhich can exclude system calls that have little impact on malware detection.\nThen we propose the SCGM, which can capture the semantic features of run-time\nprogram by grouping the system calls based on the reachability relation. We aim\nto obtain the generic representation of malicious behaviors with similar system\ncall patterns. We evaluate the performance of SCGDet using different machine\nlearning algorithms on the dataset including 854 malware samples and 740 benign\nsamples. Compared with the traditional n-gram method, the SCGDet has the\nsmaller feature space, the higher detection accuracy and the lower false\npositives. Experimental results show that SCGDet can reduce the average FPR of\n14.75% and improve the average Accuracy of 8.887%, and can obtain a TPR of\n97.44%, an FPR of 1.96% and an Accuracy of 97.78% in the best case.\n