Comparing performances of graph mining algorithms to detect malware

Abstract

Malware is one of the serious problems in the modern societies. Although the signature based malicious code detection is the standard technique in all commercial antivirus software, it can only achieve detection once the virus has already caused damage and it is registered. Therefore, it fails to detect new malwares (unknown malwares). Since most of malwares have similar behavior, a behavior based method can detect unknown malwares. The behaviors of a program can be represented by a set of called API (Application programming interface). This Sequence of API have represented as a graph. To extract feature from the API’s sequence we apply GSPAN graph mining techniques which specify every different pattern from the graph. We implemented supervised machine learning where input is as a pattern and got 99.98 accuracy.