APICapture - A tool for monitoring the behavior of malware

摘要: Malware is one of the most serious threats to security computer systems. Many approaches have been provided and various systems designed detect intrusion from anomalous behavior system calls which provide interface between a process operating system. Though these techniques look quite effective, key element seems be missing - inclusion utilization call arguments create richer, more valuable signature analyze malware accurately. Based on this problem, paper presents APICapture, tool for monitoring based whole emulator without changing kernel, automatically recording some important attributes, example, return values, error statue, etc. Experimental results show that APICapture has good transparency accuracy. Transparency means method transparent target process, making it difficult detected by malware. Moreover, information obtained can accurately completely describe functionality