Deep learning based Sequential model for malware analysis using Windows exe API Calls.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Malware development is rapidly advancing, with metamorphic malware posing significant detection challenges for traditional signature-based antivirus software.
• Classifying advanced malware, particularly metamorphic types, necessitates analyzing behavioral patterns rather than static signatures.

Purpose of the Study:

• To develop a robust malware classification method focusing on behavioral analysis.
• To address the limitations of signature-based detection against sophisticated metamorphic malware.
• To create a new, comprehensive dataset of Windows API calls for malware behavior representation.

Main Methods:

• Development of a new dataset comprising Windows API calls to represent malware behavior.
• Utilizing the Long Short-Term Memory (LSTM) neural network architecture for sequential data classification.
• Experimentation with both binary and multi-class malware classification tasks.

Main Results:

• The LSTM-based classifier achieved a high accuracy of up to 95% and an F1-score of 0.83.
• Demonstrated effective classification performance on binary and multi-class malware datasets.
• Successfully created and released a novel Windows API call dataset for malware research.

Conclusions:

• Behavioral analysis using LSTM is a highly effective approach for classifying advanced metamorphic malware.
• The newly developed Windows API call dataset provides a valuable resource for the cybersecurity research community.
• This research contributes to improving malware detection capabilities against evolving threats.