Malware Detection Using Segmented API Parameter Sequences
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods face challenges in accurately identifying malicious programs due to code obfuscation and the limitations of using API name sequences or hashing API parameters, leading to high false alarm rates and hash collisions.
Innovation Solution
A malware detection method that segments API parameters into meaningful terms and uses a Support Vector Machine (SVM) model to analyze the API sequences, incorporating domain names and IP addresses for improved accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If API parameters are hashed as a whole, then the detection process is simplified, but hash collisions occur and useful information is lost
Solution Approach 1:
The patent segments API parameters into meaningful terms (e.g., domain names, IP addresses, ports, paths) rather than hashing the entire parameter string. This segmentation allows each component to be analyzed independently, preserving useful information while reducing the risk of hash collisions and maintaining detection accuracy.
2Device complexity
If only API name sequences are used for detection, then the detection process is simpler, but detection accuracy is reduced due to loss of parameter information
Solution Approach 1:
The patent transitions from a one-dimensional API name sequence to a multi-dimensional representation that includes segmented API parameters. By adding the dimension of parameter segmentation, the system captures richer behavioral information while maintaining manageable complexity through structured data organization.
3Reliability
If code obfuscation and packing are applied to malicious programs, then the safety of static analysis is improved, but analysis difficulty increases
Solution Approach 1:
The patent uses a sandbox as an intermediary environment that executes malicious programs in a controlled manner. The sandbox captures API call sequences and parameters as intermediaries between the malicious code and the analysis system, allowing safe observation of behavior without direct exposure to the obfuscated code.
4Measurement precision
If dynamic analysis is performed in a sandbox, then malicious behaviors can be captured directly, but false alarm rates increase due to rule matching limitations
Solution Approach 1:
The patent changes the approach from traditional rule-based parameter matching to AI-based sequence analysis of segmented parameters. By transforming parameters into meaningful terms and analyzing their sequences using machine learning models, the system reduces false alarms while maintaining accurate behavior capture.
Data Source
Figure 1~2
AI summary
A malware detection method and device are provided. The method includes: running software to be detected in a sandbox, and acquiring an Application Programming Interface (API) sequence of the software to be detected, wherein the API sequence includes an API name and at least one API parameter term obtained by segmenting a corresponding API parameter (100); and determining whether the software to be detected is malware according to the API sequence of the software to be detected (101). In the method, whether software to be detected is malware is determined based on an API sequence including an API name and at least one API parameter term obtained by segmenting an API parameter, and information in a malicious behavior is fully utilized. Compared with the method in which only an API name sequence is used in the detection or in which the API parameters is hashed as a whole, the method has a better representation effect, effectively avoids interference from random numbers or irregular strings, and improves the detection accuracy by extracting meaningful strings as features for detection.