A comparison of static, dynamic, and hybrid analysis for malware detection

By Anusha Damodaran, Fabio Di Troia, Corrado Aaron Visaggio, Thomas H. Austin, Mark Steven Stamp. Journal of Computer Virology and Hacking Techniques, 2015

433 citations recorded by the source corpus.

In this research, we compare malware detection techniques based on static, dynamic, and hybrid analysis. Specifically, we train Hidden Markov Models (HMMs) on both static and dynamic feature sets and compare the resulting detection rates over a substantial number of malware families. We also consider hybrid cases, where dynamic analysis is used in the training phase, with static techniques used in the detection phase, and vice versa. In our experiments, a fully dynamic approach generally yields the best detection rates. We discuss the implications of this research for malware detection based on hybrid techniques.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/9764cb6e316293526d8b09bf307aeb25b46f1c13

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Wajih Ul Hassan
2. Wei Cheng
3. Risul Islam
4. Roberto Baldoni
5. Zhengzhang Chen
6. Carl A. Gunter
7. Leonardo Aniello
8. Haifeng Chen

In Computer Networks and Communications

1. Wajih Ul Hassan
2. Wei Cheng
3. Roberto Baldoni
4. Zhengzhang Chen
5. Carl A. Gunter
6. Leonardo Aniello
7. Haifeng Chen
8. Michalis Faloutsos

In Signal Processing

1. Roberto Baldoni
2. Carl A. Gunter
3. Leonardo Aniello
4. Qi Wang
5. Wajih Ul Hassan
6. Michalis Faloutsos
7. Evangelos E. Papalexakis
8. Daniele Ucci

Citations in the corpus

• You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis (2020, methodology): “In traditional approaches, static analysis [1], [2], [68] and dynamic analysis [69], [70], [71] have been used to analyze and detect malware.”
• SourceFinder: Finding Malware Source-Code from Publicly Available Repositories (2020, background): “There are several works that attempt to determine if a piece of software is malware, usually focusing on a binary, using static or dynamic analysis [4, 17, 35, 57].”
• Robust Intelligent Malware Detection Using Deep Learning (2019, methodology): “In [27], use of HMM on both static and Dynamic analysis of feature sets and a comparative study on detection rates was conducted over a substantial number of malware families.”
• Survey on the Usage of Machine Learning Techniques for Malware Analysis (2017, background): “Indeed, while certainly more time-consuming, dynamic analysis enables to gather features that make the overall analysis improve its e‚ectiveness [20].”