Discovering similar malware samples using API call topics

Akinori Fujino, Junichi Murakami, Tatsuya Mori

研究成果: Conference contribution

19 被引用数 (Scopus)

抄録

To automate malware analysis, dynamic malware analysis systems have attracted increasing attention from both the industry and research communities. Of the various logs collected by such systems, the API call is a very promising source of information for characterizing malware behavior. This work aims to extract similar malware samples automatically using the concept of 'API call topics,' which represents a set of API calls that are intrinsic to a specific group of malware samples. We first convert Win32 API calls into 'API words.' We then apply non-negative matrix factorization (NMF) clustering analysis to the corpus of the extracted API words. NMF automatically generates the API call topics from the API words. The contributions of this work can be summarized as follows. We present an unsupervised approach to extract API call topics from a large corpus of API calls. Through analysis of the API call logs collected from thousands of malware samples, we demonstrate that the extracted API call topics can detect similar malware samples. The proposed approach is expected to be useful for automating the process of analyzing a huge volume of logs collected from dynamic malware analysis systems.

本文言語English
ホスト出版物のタイトル2015 12th Annual IEEE Consumer Communications and Networking Conference, CCNC 2015
出版社Institute of Electrical and Electronics Engineers Inc.
ページ140-147
ページ数8
ISBN(電子版)9781479963904
DOI
出版ステータスPublished - 2015 7月 14
イベント2015 12th Annual IEEE Consumer Communications and Networking Conference, CCNC 2015 - Las Vegas, United States
継続期間: 2015 1月 92015 1月 12

出版物シリーズ

名前2015 12th Annual IEEE Consumer Communications and Networking Conference, CCNC 2015

Other

Other2015 12th Annual IEEE Consumer Communications and Networking Conference, CCNC 2015
国/地域United States
CityLas Vegas
Period15/1/915/1/12

ASJC Scopus subject areas

  • コンピュータ ネットワークおよび通信

フィンガープリント

「Discovering similar malware samples using API call topics」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル