Light-weight behavioral malware detection for windows platforms
A behavioral malware detection involves extracting features from prefetch files, wherein prefetch files; classifying and detecting benign applications from malicious applications using the features of the prefetch files; and quarantining malicious applications based on the detection.
1. A behavioral malware detection method comprising the steps of:
extracting features from prefetch files in a computer operating system, wherein prefetch files accelerate computer application launch times by monitoring and adapting to applications usage patterns over time;
representing a list of dependency file names in the prefetch files using a Bag of Words (BoW) model, wherein the list of dependency file names are the features;
classifying and detecting benign applications from malicious applications using the BoW model, wherein the classification and detection is done using Bag of Words (BoW) extraction techniques to identify feature vectors of the features that are the list of dependency file names, wherein Singular Value Decomposition (SVD) is applied to extract singular values of the feature vectors in the classification and detection of benign applications and malicious applications;
quarantining malicious applications based on the detection.
2. The behavioral malware detection method of claim 1 , wherein the prefetch files are Microsoft Windows® prefetch files.
3. The behavioral malware detection method of claim 1 , wherein the BoW extraction technique supports two different Term Frequency (TF) representations: binary and raw.
4. The behavioral malware detection method of claim 1 , wherein classification of benign applications and malicious applications is achieved using Logistic Regression.
5. The behavioral malware detection method of claim 1 , wherein the detecting of malware is classified into two classes: the benign class and malicious class.
6. The behavioral malware detection method of claim 1 , wherein the classification is performed using Logistic Regression.
7. The behavioral malware detection method of claim 1 , wherein the classification updates new families of malicious applications to improve classification.