Malware Detection Approaches Based on Operation Codes (OpCodes) of Executable Programs: A Review

Abstract

Usually, malware is analyzed in two ways: dynamic malware analysis and static malware analysis. The former collects feature datasets during the run of the malware, and involves malware API system calls, and registry, file, process, and network activities features. The latter collects feature datasets without the run of the malware, and involves OpCodes and text features. Several previous studies have addressed the review of the malware detection approaches based on various feature datasets, but none of them has addressed the review of the approaches merely based on malware OpCodes features. Therefore, this study aimed to review the malware detection approaches only based on OpCodes features and deduced that there is a positive relationship between the Study Year and the Detection Ratio. Besides, incorporating the improved deep learning (DL) in the approaches for detecting malware only based on OpCodes achieved 1.427 times greater accurate detection ratio.