MoG: Behavior-Obfuscation Resistance Malware Detection. (4th June 2019)

• Record Type: Journal Article
• Authors: Cheng, Binlin; Liu, Jinjun; Chen, Jiejie; Shi, Shudong; Peng, Xufu; Zhang, Xingwen; Hai, Haiqing
• Editors: Furnell, Steven
• Is Part Of: Computer journal. Volume 62:Number 12(2019)
• Page Start: 1734
• Page End: 1747
• Publication Date: 2019-06-04
• Subjects: malware -- behavior-based analysis -- API call -- object operation; Computers -- Periodicals; 005.1
• DOI: 10.1093/comjnl/bxz033
• Languages: English
• ISSNs: 0010-4620

Abstract

Abstract: Malware brings a big security threat on the Internet today. With the great increasing malware attacks. Behavior-based detection approaches are one of the major method to detect zero-day malware. Such approaches often use API calls to represent the behavior of malware. Unfortunately, behavior-based approaches suffer from behavior obfuscation attacks. In this paper, we propose a novel malware detection approach that is both effective and efficient. First, we abstract the API call to object operation. And then we generate the object operation dependency graph based on these object operations. Finally, we construct the family dependency graph for a malware family. Our approach use family dependency graph to represent the behavior of malware family. The evaluation results show that our approach can provide a complete resistance to all types of behavior obfuscation attacks, and outperforms existing behavior-based approaches in terms of better effectiveness and efficiency.