Abstract:

A malware detection method based on minimum behavior is proposed. Minimum behavior is defined as application programming interface (API) subsets which the malicious code operates on each resource at runtime. A malicious software (malware) detecting system based on minimum behavior is implemented to dynamically capture the system calls, and construct the signature of malware by extracting the defined use (def-use) relation between systems calls, and then detect the malware using a chisquare test algorithm. Compared with the method based on the frequency of API, the proposed method has a higher true positive fraction, and the false positive fraction is lower.