# Malware Detection Approach Based on Artifacts in Memory Image and Dynamic Analysis
## 4 Results and Discussion
### Features in Memory and Dynamic Analysis  
In order to expand our study of malware behaviors in memory, the API features extracted from the memory analysis with features extracted from the dynamic analysis for each file were compared. There are features found in the memory analysis that have not been seen in the dynamic analysis report. This means that the malware did not execute those APIs. It is known that dynamic analysis is limited to a single view of path execution and, therefore, unexecuted API calls do not appear in the behavior report. However, unexecuted APIs could reveal another side of malware behavior [3]. Table 5 shows the 20 most prominent features that appear in the memory analysis but not in the dynamic analysis with their frequencies and percentages. To exemplify, the RtlEncodePointer and RtlDecodePointer features were found in 630 files in the memory analysis, in 52.5% of the total data set, but not seen during monitoring the execution of that file (dynamic analysis). The TerminateProcess feature was not  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Author** & **Year** & \
\begin{tabular}{c} **Extracted** \\ **Feature (s)** \\ \end{tabular} &
\begin{tabular}{c} **Malware** \\ **(M)/Benign (B)** \\ \end{tabular} & **Accuracy** & **False Positive** \\ \hline
**Mosli [4]** & 2016 & \
\begin{tabular}{c} Registry, DLLs, \\ API calls. \\ \end{tabular} &
\begin{tabular}{c} M = 400 \\ B = 100 \\ M = 3130 \\ B = 1157 \\ \end{tabular} & 96\% & 5\% \\
**Dai [28]** & 2017 & \
\begin{tabular}{c} Number of \\ handles. \\ \end{tabular} &
\begin{tabular}{c} M = 3130 \\ B = 1157 \\ \end{tabular} & 91.4\% & - \\
**Dai [29]** & 2018 & API calls. & M = 1984 & 95.2\% & - \\
**Aghaeikheirabady** & 2014 &
\begin{tabular}{c} DLL, API calls, \\ Registry. \\ \end{tabular} & - & 98\% & 16\% \\
**Proposed method** & 2019 & API calls. &
\begin{tabular}{c} M = 1200 \\ B = 400 \\ \end{tabular} & 98.5\% & 1.7\% \\ \hline \hline \end{tabular}
\end{table}
Table 4: Comparing experimental results with other memory related work.  
Figure 6: A comparison between the evaluation rates from the memory, dynamic and integrated analyses.  
found 314 times through the execution of 1200 malicious samples. Therefore, the authors believe that memory forensic analysis overwhelms the shortage of single path execution in dynamic analysis.  
In addition to the features in Table 5, there are more than 2821 distinct features that have not been seen in the behavior analysis reports. There are two assumptions for the unexecuted features--either the malware did not execute these features yet, or it did not want to execute them. It is possible that the malware did not perform some of its activities because of the time limit of dynamic analysis, which is commonly 2-5 min. The second assumption is that the malware is trying to hide its activities or part of it, which is also common for smart malware to act normally when they are placed under analysis in order not to show any malicious actions. However, in both cases, the inspecting memory can reveal unrecorded behaviors of the malware and can also help in extracting additional features. Therefore, the memory analysis and behavior analysis were integrated in order to find malware hidden features and improve the classification of the proposed approach.