| Title | A Malware Similarity Analysis Method Based on Network Control Structure Graph |
| Publication Type | Conference Paper |
| Year of Publication | 2020 |
| Authors | Wang, Duanyi, Shu, Hui, Kang, Fei, Bu, Wenjuan |
| Conference Name | 2020 IEEE 11th International Conference on Software Engineering and Service Science (ICSESS) |
| Keywords | control branch point, feature extraction, graph theory, Human Behavior, Malware, malware analysis, Metrics, network control structure graph, privacy, pubcrawl, resilience, Resiliency, Resists, similarity analysis, Software algorithms, software engineering, Strain, Training |
| Abstract | Recently, graph-based malware similarity analysis has been widely used in the field of malware detection. However, the wide application of code obfuscation, polymorphism, and deformation changes the structure of malicious code, which brings great challenges to the malware similarity analysis. To solve these problems, in this paper, we present a new approach to malware similarity analysis based on the network control structure graph (NCSG). This method analyzed the behavior of malware by application program interface (API) association and constructed NCSG. The graph could reflect the command-and-control(C&C) logic of malware. Therefore, it can resist the interference of code obfuscation technology. The structural features extracted from NCSG will be used as the basis of similarity analysis for training the detection model. Finally, we tested the dataset constructed from five known malware family samples, and the experimental results showed that the accuracy of this method for malware variation analysis reached 92.75%. In conclusion, the malware similarity analysis based on NCSG has a strong application value for identifying the same family of malware. |
| DOI | 10.1109/ICSESS49938.2020.9237633 |
| Citation Key | wang_malware_2020 |
A Malware Similarity Analysis Method Based on Network Control Structure Graph