Malware detection via API calls, topic models and machine learning

TLDR: This work presents a model that uses text mining and topic modeling to detect malware, based on the types of API call sequences, and recommends Decision Tree as it yields `if-then' rules, which could be used as an early warning expert system.

Abstract: Dissemination of malicious code, also known as malware, poses severe challenges to cyber security Malware authors embed software in seemingly innocuous executables, unknown to a user The malware subsequently interacts with security-critical OS resources on the host system or network, in order to destroy their information or to gather sensitive information such as passwords and credit card numbers Malware authors typically use Application Programming Interface (API) calls to perpetrate these crimes We present a model that uses text mining and topic modeling to detect malware, based on the types of API call sequences We evaluated our technique on two publicly available datasets We observed that Decision Tree and Support Vector Machine yielded significant results We performed t-test with respect to sensitivity for the two models and found that statistically there is no significant difference between these models We recommend Decision Tree as it yields ‘if-then’ rules, which could be used as an early warning expert system