|
概要（英語）
|
In recent years, various cyber attacks have been serious issue. Therefore, a lot of researches have been done, such as the analysis of the difference between benign software and malware, malware family estimation, and the visualization of malware behaviours. These studies make use of API call sequences, readable character strings, system load, etc. However, the difference between parent and child processes has not been focused and enough investigated. In this paper, we focus on the similarity of API call sequences between the parent and child processes of benign software and malware. We use natural language processing techniques such as TF-IDF, n-gram, and Doc2Vec to vectorize the API call sequences, and then calculate the cos-similarity to measure the similarity between parent and child processes. We attempt to apply the similarity scores to SVMs for the inference of benign software and malware.
|