MalDAE: Detecting and explaining malware based on correlation and fusion of static and dynamic characteristics

摘要: Abstract It is a wide-spread way to detect malware by analyzing its behavioral characteristics based on API call sequences. However, previous studies usually just focus static or dynamic sequence, while neglecting the correlation between them. Our experimental results show that there exists an underlying relation and sequences of malware. The can be described as “the syntax different, but semantics similar”. Based this discovery, paper first attempts explore difference malicious programs. We correlate fuse their into one hybrid sequence mapping then construct feature vector space. Furthermore, we mine define behavior types programs, provide explainable for detection. study has addressed shortcoming approaches they pay attention detection neglect explanation. By fusion sequences, establish framework, called MalDAE. evaluation classification accuracy MalDAE reach up 97.89% 94.39% respectively outperforming similar comprehensive comparison. In addition, gives understandable explanation common provides predictive support understanding resisting