A Feature Extraction Method of Hybrid Gram for Malicious Behavior Based on Machine Learning. (4th February 2019)

• Record Type: Journal Article
• Authors: Zhao, Yuntao; Bo, Bo; Feng, Yongxin; Xu, ChunYu; Yu, Bo
• Other Names: Chen Jiageng Guest Editor.
• Is Part Of: Security and communication networks. Volume 2019(2019)
• Publication Date: 2019-02-04
• Subjects: Computer networks -- Security measures -- Periodicals; Computer security -- Periodicals; Cryptography -- Periodicals; 005.805
• DOI: 10.1155/2019/2674684
• Languages: English
• ISSNs: 1939-0114

Abstract

Abstract : With explosive growth of malware, Internet users face enormous threats from Cyberspace, known as "fifth dimensional space." Meanwhile, the continuous sophisticated metamorphism of malware such as polymorphism and obfuscation makes it more difficult to detect malicious behavior. In the paper, based on the dynamic feature analysis of malware, a novel feature extraction method of hybrid gram (H-gram) with cross entropy of continuous overlapping subsequences is proposed, which implements semantic segmentation of a sequence of API calls or instructions. The experimental results show the H-gram method can distinguish malicious behaviors and is more effective than the fixed-length n-gram in all four performance indexes of the classification algorithms such as ID3, Random Forest, AdboostM1, and Bagging.