# Malware Detection Approach Based on Artifacts in Memory Image and Dynamic Analysis
## 2 Related Work  
Researchers have used different techniques to analyze and detect malware. Several researchers used static analysis to detect malware. [PERSON] and [PERSON] [8] used machine learning to detect malware after extracting the unique opcode feature from executable files using static analysis. [PERSON] et al. [6] extracted the application programming interface (API) calls from each file and selected the most frequent APIs to learn the classifier. Similarly, [PERSON] et al. [9] used the WinDBg tool to extract native APIs and applied SVM to classify malware in the shellcode. [PERSON] et al. [10] proposed a method that uses static analysis to extract opcode sequences from 32-bit and 64-bit malicious portable executable (PE) Windows files. The frequency for each opcode sequence is then calculated and used to distinguish the different types of malicious PE files. The experiment evaluated on more than 20,000 samples collected from the vx-heaven data set and Kaggle Microsoft Malware Classification Challenge (BIG 2015) data set. The results showed that the highest accuracy equal to 98.57% by applying the Adaboost classifier. Further, [PERSON] et al. [11] investigated the vulnerability of malware detection methods that use deep networks to learn from row bytes and proposed a gradient-based attack which was able to evade detection by modifying a few bytes at the end of each malware file. On the other hand, many authors used dynamic analysis in malware detection and classification. In [12], [PERSON] et al. surveyed the dynamic analysis and feature extraction techniques along with the available tools that have been used in dynamic analysis. [PERSON] et al. [13] extracted a registry file system and network features and classified Zeus malware. Following this, [PERSON] et al. [14] introduced an automated and behavior-based malware analysis and labeling system (AMAL). The features, such as the file system, registry and network activity were used to study malware files. In [15], [PERSON] et al. introduced a classification technique that calculates the similarity between malware variants based on the API dependency chain. Likewise, [PERSON] et al. [16] captured information about API calls and its parameters by applying the API hook. The API calls that have mutual purposes were put into sequences. Similarly, [PERSON] et al. [17] applied API hooking to trace hidden API calls and native APIs. [PERSON] et al. [18] also extracted user level API call sequences, using the Detours tool, and applied a multiple sequence alignment algorithm (MSA) to match similar sequences. In [19], [PERSON] et al. introduced a malware detection method that represents malware behaviors based on API as dependency graphs. To find the relationship between system calls, a dynamic taint analysis technique was used. The system call dependency graph was built according to the propagation of the taint data. They also proposed an algorithm that extracts behavioral features of a malware family. Finally, a malicious code was detected using a maximum weight subgraph. The results of the experiment show that the behavior graph API-based can represent a malware family with accuracy equal to 95.2%. Some researchers chose to extract hybrid features from static and dynamic analyses in representing their malware detection approaches. [PERSON] and [PERSON] [20] extracted printable strings information (PSI) features by performing a static analysis and API calls from a dynamic analysis. Likewise, [PERSON] et al. [21] applied static analysis to extract the function length frequency (FLF) and printable string information (PSI) features, and used dynamic analysis to extract API calls and API parameters. In [22], [PERSON] et al. presented a tool that is able to capture malware files (OPEM). [PERSON] applied static analysis to extract opcode frequency and system calls, and dynamic analysis for operations and raised exceptions. Several types of research concerning memory analysis have been proposed.