International Journal of Network Security & Its Applications (IJNSA)

International Journal of Network Security & Its Applications (IJNSA)

ISSN: 0974 - 9330 (Online); 0975 - 2307 (Print)

http://airccse.org/journal/ijnsa.html

Comparison of Malware Classification Methods using Convolutional Neural Network based on API Call Stream

Matthew Schofield, Gulsum Alicioglu, Bo Sun, Russell Binaco, Paul Turner, Cameron Thatcher, Alex Lam and Anthony Breitzman, Rowan University, USA

ABSTRACT

Malicious software is constantly being developed and improved, so detection and classification of malwareis an ever-evolving problem. Since traditional malware detection techniques fail to detect new/unknown malware, machine learning algorithms have been used to overcome this disadvantage. We present a Convolutional Neural Network (CNN) for malware type classification based on the API (Application Program Interface) calls. This research uses a database of 7107 instances of API call streams and 8 different malware types:Adware, Backdoor, Downloader, Dropper, Spyware, Trojan, Virus,Worm. We used a 1-Dimensional CNN by mapping API calls as categorical and term frequency-inverse document frequency (TF-IDF) vectors and compared the results to other classification techniques.The proposed 1-D CNN outperformed other classification techniques with 91% overall accuracy for both categorical and TFIDF vectors.

KEYWORDS

Convolutional Neural Network, Malware Classification, N-gram Analysis, Term Frequency-Inverse Document Frequency Vectors, Windows API Calls

Original Source URL: https://aircconline.com/ijnsa/V13N2/13221ijnsa01.pdf

Volume Link: http://airccse.org/journal/jnsa21_current.html