Analysis of malware by integrating API extracted from dynamic and memory analysis. (15th September 2021)

• Record Type: Journal Article
• Authors: Kumar, Nishant; Yadav, Lokesh; Tomar, Deepak Singh
• Is Part Of: International journal of swarm intelligence. Volume 6:Number 2(2021)
• Page Start: 93
• Page End: 105
• Publication Date: 2021-09-15
• Subjects: malware -- malware analysis -- memory dumps -- dynamic analysis -- API calls -- machine learning; Swarm intelligence -- Periodicals; 006.3
• Languages: English
• ISSNs: 2049-4041

Abstract

Nowadays, malware is being developed and implemented on a large-scale, which poses a critical security threat to digital devices. Therefore, effective analysis of malware is an important concern for security experts. Malware software exploits security vulnerabilities of the device and compromises the security of computing settings. Static analysis is a time-consuming approach and requires a lot of manual effort. To overcome this limitation, dynamic analysis was carried in this paper by performing malicious code execution capable enough in identifying multi-functional malware. Sometimes dynamic analysis is unable to handle obfuscated malware due to its API hooking capability. Hence, an approach was applied to combine dynamic analysis technique with memory analysis technique to provide an effective and efficient method for analysing malware using API calls. This approach was performed in a safe and isolated environment to capture the behaviour of the malware. This study shows a noteworthy improvement in accuracy, i.e., 98.62% and reduction in false positive rate, i.e., 1.3%.