检索结果-内蒙古大学图书馆

RanViz: Ransomware Visualization and Classification Based on Time-Series Categorical Representation of api calls

IEEE ACCESS 2025年 13卷 56237-56254页

作者： Mokoma, Vhuhwavho Singh, Avinash Univ Pretoria Dept Comp Sci ZA-0002 Pretoria South Africa

Ransomware continues to pose a significant threat to individuals and organizations worldwide, causing disruptions, financial losses, and reputational damage. As ransomware attacks grow in sophistication, understanding their behaviour through effective analysis has become increasingly critical for mitigation and prevention. However, ransomware analysis presents several challenges. First, the sheer volume of Application Programming Interface (api) call data generated by ransomware during execution can overwhelm traditional analysis methods. Second, the temporal and categorical nature of this data makes identifying meaningful patterns complex. Third, the integration of machine learning (ML) models, which are essential for accurate classification, is hindered by the difficulty of modelling intricate api call behaviours. Without effective tools to address these issues, analysts risk missing critical behavioural indicators. To overcome these challenges, the proposed Ransomware Visualization (RanViz) system was developed to provide a comprehensive visual analytics and classification platform designed to enhance ransomware analysis. RanViz employs advanced visualization techniques to represent categorical api call time-series data, enabling analysts to intuitively understand ransomware behaviours that might otherwise remain obscured. The system incorporates ML models based on api call frequency, temporal interval, and sequence to classify unknown samples as either benign or ransomware. The models collectively achieve an accuracy of over 95% in detecting ransomware. By providing a unified platform that combines powerful visualization tools with high-performing ML models, RanViz simplifies ransomware analysis and offers a robust framework for accurate classification. This makes it an invaluable tool for digital forensics and cybersecurity professionals tasked with addressing the ever-evolving ransomware threat.

关键词： Ransomware Malware Data visualization Application programming interfaces Encryption Visual analytics Organizations Computer security Complexity theory Ransomware analysis api calls machine learning ransomware time series visualization visualization

来源：评论

学校读者我要写书评

暂无评论

Android Malware Detection Method Based on Permission Complement and api calls

引用

Chinese Journal of Electronics 2022年第4期31卷 773-785页

作者： YANG Jiyun TANG Jiang YAN Ran XIANG Tao College of Computer Science Chongqing University

The dynamic code loading mechanism of the Android system allows an application to load executable files externally at runtime. This mechanism makes the development of applications more convenient, but it also brings security issues. Applications that hide malicious behavior in the external file by dynamic code loading are becoming a new challenge for Android malware detection. To overcome this challenge, based on dynamic code loading mechanisms, three types of threat models,i.e. Model I, Model II, and Model III are defined. For the Model I type malware, its malicious behavior occurs in Dex Code, so the application programming interface(api)classes were used to characterize the behavior of the DexCode file. For the Model II type and Model III type malwares whose malicious behaviors occur in an external file,the permission complement is defined to characterize the behaviors of the external file. Based on permission complement and api calls, an Android malicious application detection method is proposed, of which feature sets are constructed by improving a feature selection method. Five datasets containing 15,581 samples are used to evaluate the performance of the proposed method. The experimental results show that our detection method achieves accuracy of 99.885% on general dataset, and performes the best on all evaluation metrics on all datasets in all comparison methods.

关键词： Android malicious application detection method threat models api calls Data security malicious behavior Android malware detection method Operating systems DexCode file executable files application programming interface classes Android (operating system) Ubiquitous and pervasive computing permission complement invasive software external file dynamic code loading mechanism application program interfaces feature selection method feature selection

来源：评论

学校读者我要写书评

暂无评论

Intelligent mobile malware detection using permission requests and api calls

引用

FUTURE GENERATION COMPUTER SYSTEMS-THE INTERNATIONAL JOURNAL OF ESCIENCE 2020年 107卷 509-521页

作者： Alazab, Moutaz Alazab, Mamoun Shalaginov, Andrii Mesleh, Abdelwadood Awajan, Albara Al Balqa Appl Univ Fac Artificial Intelligence Salt Jordan Charles Darwin Univ Coll Engn IT & Environm Darwin NT Australia Norwegian Univ Sci & Technol Fac Informat Technol & Elect Engn Trondheim Norway

Malware is a serious threat that has been used to target mobile devices since its inception. Two types of mobile malware attacks are standalone: fraudulent mobile apps and injected malicious apps. Defending against the cyber threats of mobile malware requires a strong understanding of the permissions declared in applications and application programmeinterface (api) calls. In this paper, we propose an effective classification model that combines permission requests and api calls. As Android apps use a large number of apis, we propose three different grouping strategies for choosing the most valuable api calls to maximize the likelihood of identifying Android malware apps: the ambiguous group, risky group, and disruptive group. The results demonstrate that compared with benign apps, malicious applications invoke a different set of api calls and that mobile malware often requests dangerous permissions to access sensitive data more often than benign apps. Empirical results obtained with a real malware dataset containing 27,891 Android apps suggest that our proposed method is effective at detecting mobile malware apps and achieves an F-measure of 94.3%. Our model can significantly assist in the process of malware forensic investigation and mobile application analysis. (C) 2020 Elsevier B.V. All rights reserved.

关键词： Mobile malware Malware detection Mobile security IoT api calls Android permissions

来源：评论

学校读者我要写书评

暂无评论

Feature mining and classifier selection for api calls-based malware detection

引用

APPLIED INTELLIGENCE 2023年第23期53卷 29094-29108页

作者： Balan, Gheorghe Simion, Ciprian-Alin Gavrilut, Dragos Teodor Luchian, Henri Alexandru Ioan Cuza Univ Fac Comp Sci Iasi Romania Bitdefender Cyber Threat Intelligence Lab Iasi Romania

This paper deals with a major challenge in cyber-security: the need to respond to ever renewed techniques used by attackers in order to avoid detection based on analysing static features of malware. These constantly renewed techniques consist of various changes in file geometry, entropy a.s.o. As a consequence, static malware features sets describe less and less accurately the malicious files;hence, the performance of machine learning models in detecting new variants of the same malware family may be severely impaired. The paper focuses on a promising approach to this detection challenge: defining file features based on OS (operating system) api (Application Program Interface) calls sequences. We explore in detail the detection potential of such features, since, in order to act maliciously, these features are highly unlikely to be hidden. We studied several tens of thousands of such features, a modest-sized subset of which were subsequently fed to several machine learning models. The database used for training and testing consists of 1.5 million files, including malicious files from the polymorphic families Emotet and Trickbot. Using this database, nearly 4,000 pairings (classifier, feature selection algorithm) were trained / tested. Our experimental results show that the api (Application Program Interface) calls-oriented feature mining process is well suited for detecting polymorphic malware. A comparative discussion of the detection results of the various models is presented;depending on the target optimisation criterion (detection rate / false positive rate / saving resources), three of the 4,000 classification models turn out to be best suited for real-world applications: Random Forrest, Legacy Neural Networks and Decision Tree.

关键词： Malware detection Feature mining Behavioural features api calls Emulators

来源：评论

学校读者我要写书评

暂无评论

STATIC DETECTION OF ANDROID MALWARE BY USING PERMISSIONS AND api calls 13

STATIC DETECTION OF ANDROID MALWARE BY USING PERMISSIONS AND...

引用

International Conference on Machine Learning and Cybernetics

作者： Chan, Patrick P. K. Song, Wen-Kai South China Univ Technol Dept Comp Sci & Technol Guangzhou 510006 Guangdong Peoples R China

ISBN: (纸本)9781479942152

Android smart phones have become more and more popular due to its increasing functionalities, compatibility and convenience. More and more Android applications have been developed and can be downloaded easily from app markets. However, Android malwares have increased significantly in recent years. In this paper, we proposed a feature set containing the permissions and api calls for Android malware static detection. Classifiers that used the proposed feature set outperform those only with the permissions experimentally. It showed that the information of api calls is helpful in recognizing Android malware.

关键词： Smart phones Android malware Permissions api calls

来源：评论

学校读者我要写书评

暂无评论

Mining api calls and Permissions for Android Malware Detection 13

Mining API Calls and Permissions for Android Malware Detecti...

引用

13th International Conference on Cryptology and Network Security (CANS)

作者： Sharma, Akanksha Dash, Subrat Kumar LNM Inst Informat Technol Dept Comp Sci & Engn Jaipur Rajasthan India

ISBN: (纸本)9783319122809;9783319122793

The popularity of Android platform is increasing very sharply due to the large market share of Android and openness in nature. The increased popularity is making Android an enticing target for malwares. A worrying trend that is alarming is the increasing sophistication of Android malware to evade detection by traditional signature based scanners. Several approaches have been proposed in literature for Android malware detection. However, most of them are less effective in terms of true positive rate and involves computational overheads. In this paper, we propose an effective approach to attenuate the problem of Android malware detection using static code analysis based models. The proposed models, in this paper, are built to capture features relevant to malware behaviour based on api calls as well as permissions present in various Android applications. Thereafter, models are evaluated using Naive Bayesian as well as K-Nearest Neighbour classifiers. Proposed models are able to detect real malwares in the wild and achieve an accuracy of 95.1% and true positive rate with highest value one.

关键词： Android malware detection api calls Permissions Feature Selection Classification

来源：评论

学校读者我要写书评

暂无评论

Using api calls for Sequence-Pattern Feature Mining-Based Malware Detection 17th

Using API Calls for Sequence-Pattern Feature Mining-Based Ma...

引用

17th International Conference on Information Security Practice and Experience (ISPEC)

作者： Balan, Gheorghe Gavrilut, Dragos Teodor Luchian, Henri Alexandru Ioan Cuza Univ Fac Comp Sci IaSi Bitdefender Labs Iasi Romania Alexandru Ioan Cuza Univ Fac Comp Sci Iasi Iasi Romania

ISBN: (纸本)9783031212796;9783031212802

This paper presents an ANN-based approach to malware detection focused on sequence-pattern feature mining. Some prevalent malware families (Emotet, Trickbot) try to deceive detection algorithms by automatically changing their file format with each attack campaign;consequently, detection based on features derived directly from the content of a suspected file can be avoided by this type of polymorphic malware. However, while a given malware can easily be changed in terms of its static characteristics, the same cannot be said for the behavioural it exhibits. This paper focuses on building ANN models using behaviour features related to OS api calls sequences that can improve malware detection. Our experiments with Feed Forward Neural Networks having as input such features (obtained via emulators) show that this is a promising approach against polymorphic malware families, well-suited for real-world applications.

关键词： Neural networks Feature-mining api calls Emulators Malware Emotet family detection Trickbot family detection Behavioral features

来源：评论

学校读者我要写书评

暂无评论

Analysis of api calls with 'A' and 'W' suffixes used in parent and child processes for ransomware detection 12

Analysis of API calls with 'A' and 'W' suffixes used in pare...

引用

12th International Symposium on Computing and Networking

作者： Matsuda, Yoshiki Takahashi, Kenichi Higashino, Masayuki Kawamura, Takao Tottori Univ Grad Sch Sustainabil Sci Tottori Japan Tottori Univ Cross Informat Res Ctr Grad Sch Sustainabil Sci Tottori Japan

ISBN: (纸本)9798331528379;9798331528362

In recent years, the impact of ransomware attacks has been increasing. Consequently, numerous studies on ransomware detection have been conducted. These studies often focus on the api calls used by ransomware. Ransomware frequently generates multiple child processes to conceal malicious behaviors such as file encryption. However, existing research does not focus on the characteristics of child and parent processes. In this paper, we analyze the number of processes generated by ransomware and benign software as well as the Windows api calls of each processes. As the result of our analysis, we found that ransomware exhibits specific characteristics in api calls with 'A' and 'W' suffixes used in parent and child processes, which differ from those in benign software. Thus, we attempt to detect ransomware by using these characteristics of parent and child processes. Our results confirm that the characteristics of parent and child processes are effective for ransomware detection.

关键词： ransomware api calls parent process child process

来源：评论

学校读者我要写书评

暂无评论

Malware Detection using api calls Visualisations and Convolutional Neural Networks 23

Malware Detection using API Calls Visualisations and Convolu...

引用

23rd IEEE/ACM International Symposium on Cluster, Cloud and Internet Computing (CCGrid)

作者： Pizarro Barona, Jaime Avila Alvarez, Joseph Jimenez Farfan, Carlos Marquez Aguilar, Joangie Bonilla, Rafael I. Escuela Super Politecn Litoral Fac Ingn Elect & Computac Guayaquil Ecuador

ISBN: (纸本)9798350302080

This research explores and analyzes different api calls sequence transformation methods into images to train deep learning models and determine which combination of these methods and models performs better. We generated images from api calls sequences using Simhash and FreqSeq. The results were compared by training two well-known Convolutional Network architectures (ResNet50v2 and MobileNetv2). This work presents our experience running these experiments highlighting the results obtained and the challenges we faced.

关键词： malware detection api calls artificial intelligence deep learning convolutional neural networks

来源：评论

学校读者我要写书评

暂无评论

Multiclass Malware Classification Using Either Static Opcodes or Dynamic api calls 35th

Multiclass Malware Classification Using Either Static Opcode...

引用

35th Australasian Joint Conference on Artificial Intelligence (AI)

作者： Chanajitt, Rajchada Pfahringer, Bernhard Gomes, Heitor Murilo Yogarajan, Vithya Univ Waikato Dept Comp Sci Hamilton New Zealand Victoria Univ Wellington Sch Engn & Comp Sci Wellington New Zealand Univ Auckland Sch Comp Sci Auckland New Zealand

ISBN: (纸本)9783031226946;9783031226953

Today's malware variants are growing at an unprecedented rate. To avoid detection by existing antivirus engines, attackers have been increasing the complexity of packers, layers of obfuscation, and encryption to obstruct the process of reverse engineering. This paper presents an automated method using static analysis for extracting opcode sequences of a length of up to 5000 and employing these sequences for classifying potential malware into eight classes, namely ransomware, trojan, backdoor, rootkit, virus, miner, benign, and other. Our empirical analysis compares four different classifiers: MLP, LSTM, GRU, and Transformer. The experimental results demonstrate that the GRU approach achieves the highest F1-score of up to 87%. In addition, we analyze dynamic api call sequences. We use a public malware dataset that comprises more than 7000 sample sequences of 342 api calls each for apps from eight different malware families. A GRU network achieves the best result for this dataset, producing an F1-score of 78%.

关键词： Opcode api calls MLP GRU Transformer

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：