Efficient Graph-Based Malware Detection Using Minimized Kernel and SVM

Malware detection is a classification process that characterizes software samples as malicious or benign. Malware analysis extracts software sample features through static and/or dynamic methods and provides these features to classifiers. We present a static, graph-based method which creates API call graphs from executable samples and applies machine learning to classify them as malicious or benign. In our method, we extract the API calls that a sample makes to the operating system, we create an API call graph, and then, we construct a related abstract API call graph. Subsequently, we calculate a similarity measure of the abstract API call graph with the samples of a given dataset that includes labeled benign and malware samples. The similarity calculations are made using an efficient random walk graph kernel, which exploits constraints of the problem and leads to more efficient calculations relatively to the state of the art. Finally, we use a support vector machine (SVM) algorithm to divide the similarity vector space and perform classification. We evaluate our method for two different cases, unweighted and weighted abstract API call graphs, demonstrating achievement of more than 99.15% accuracy and outperforming current methodologies accuracies by employing the weighted abstract API call graph.