关键词: 恶意软件检测, 行为依赖图, 动态污点分析, 频繁子图, 分类

Abstract: In graph-based malware detection methods, we must build a behavior dependency graph for each known malware, therefore the number of behavior graphs is huge and the matching process is time-consuming, therefore, they are difficult to apply in practice. To solve this issue, we propose a malware detection method based on frequent subgraphs mining of malware family behavior. First, we use a dynamic taint analysis technique to mark the system call parameters with taint tags. Second, we build the system API call relational file by tracing the propagation of the taint data, and the behavior dependency graph of a single sample is then generated. we propose an algorithm to extract the behavior frequent subgraphs, which is used to represent the behavioral features of a malware family. Finally, compared with traditional malware detection methods based on API call sequence and single malware behavior dependency graphs, the detection effect of our method is not affected by code obfuscation technology, reduces the amount of behavior dependency graphs without losing the malicious behavior features and has a high detection rate and a high positive rate.

Key words: malware detection, behavior graphs, dynamic taint analysis, frequent subgraphs, classification