Packed malware variants detection using deep belief networks

¹ Strategic Support Force Information Engineering University, Zhengzhou, 450000, China
² DaTang Centrol-China Electric Power Test Research Institute, Zhengzhou, 450006, China

^* Corresponding author: 957473068@126.com

Abstract

Malware is one of the most serious network security threats. To detect unknown variants of malware, many researches have proposed various methods of malware detection based on machine learning in recent years. However, modern malware is often protected by software packers, obfuscation, and other technologies, which bring challenges to malware analysis and detection. In this paper, we propose a system call based malware detection technology. By comparing malware and benign software in a sandbox environment, a sensitive system call context is extracted based on information gain, which reduces obfuscation caused by a normal system call. By using the deep belief network, we train a malware detection model with sensitive system call context to improve the detection accuracy.