Malware Detection Using API Function Frequency with Ensemble Based Classifier

Abstract

Malicious code, known as malware, when executed can steal information, damage the system or may cause unavailability of system resources. In order to safeguard information systems from malware, effective detection of malware is a top priority task. Malware exhibits malicious behaviors like connecting to a remote host, downloading file from remote host, creating file in system directory etc. These behaviors can be mapped to functions used by malicious files which are imported from system’s dynamic link libraries i.e. Application programming interface (API) functions. Hence, we propose a technique to detect malware using API function frequency as feature vector for classifying malicious file. We use Ensemble based classifier for classification, as it is proven to be stable and robust classification technique. Experiments are conducted over 200 files and the technique classified malicious files effectively. Bagging used in ensemble classifier provides better results as compared to ensemble boosting. Comparison with other known techniques is also listed.