The research presented, investigates the optimal set of operational codes (opcodes) that create a robust indicator of malicious software (malware) and also determines a program's execution duration for accurate classification of benign and malicious software. The features extracted from the dataset are opcode density histograms, extracted during the program execution. The classifier used is a support vector machine and is configured to select those features to produce the optimal classification of malware over different program run lengths. The findings demonstrate that malware can be detected using dynamic analysis with relatively few opcodes.
Researchers in REF investigate the optimal set of instructions being executed to identify obfuscated Android malware using the SVM classifier.
Detecting obfuscated malware using reduced opcode set and optimised runtime trace
Security Informatics
Security Informatics
Computer Science