A Novel Malware Detection Approach Based on Behavioral Semantic Analysis and LSTM Model

Malware has been a major security threat to cyberspace. To identify the maliciousness of a program, researchers usually extract relevant semantic features from the program to analyze the operational intent of the program, and the most common object of analysis is the sequence of system calls of the program. System call sequences can effectively reflect the behavioral characteristics of a program, but are relatively low-level and poorly comprehensible, making it difficult to intuitively reflect the behavioral intent of a program. For this reason, this paper further analyzes the operation behavior types corresponding to the program system calls on the basis of the analysis of the program system call sequences, so as to realize the understanding of the program behavior semantics based on the analysis of the program behavior operation sequences. In this paper, 15 behavior types are defined to characterize the behavior semantics of the program, and the program feature vector is constructed by extracting the operation sequence of the program behavior types, which can simplify the complexity of the feature vector and understand the behavior operation intention of the program more accurately, and finally the detection accuracy of the classifier constructed based on the deep learning model LSTM can reach 96.14 %.