Malware Analysis and Classification: A Survey

By Ekta Gandotra, Divya Bansal, Sanjeev Sofat. 2014

430 citations recorded by the source corpus.

One of the major and serious threats on the Internet today is malicious software, often referred to as a malware. The malwares being designed by attackers are polymorphic and metamorphic which have the ability to change their code as they propagate. Moreover, the diversity and volume of their variants severely undermine the effectiveness of traditional defenses which typically use signature based techniques and are unable to detect the previously unknown malicious executables. The variants of malware families share typical behavioral patterns reflecting their origin and purpose. The behavioral patterns obtained either statically or dynamically can be exploited to detect and classify unknown malwares into their known families using machine learning techniques. This survey paper provides an overview of techniques for analyzing and classifying the malwares.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/c4e8602f2a2a57803d813892fc325d3f2fecf965

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Efficient Detection of Zero-day Android Malware Using Normalized Bernoulli Naive Bayes (2015, methodology): “Extracted features have been used for malware classification in several areas, including Data Mining [7], Machine Learning [8], Clustering [9], etc. Graph representations are widely used for code analysis.”
Deep neural network based malware detection using two dimensional binary program features (2015, methodology): “Machine learning has been applied to malware detection at least since [25], with numerous approaches since (see reviews [12, 17]).”
Evaluation and Design of Robust Neural Network Defenses (2018, methodology): “In the space of malware, machine learning has been used to detect malware from benign files [21, 104, 20, 29, 60, 108] (even using neural networks [24]) and an equal amount of work has been performed on attacking such classifiers [75, 134, 89, 92].”
A Survey on Machine Learning Techniques for Cyber Security in the Last Decade (2020, background): “Machine learning techniques are not only capable of identifying zero-day attacks but also outperform in detecting new or obfuscated malware attacks [70], [532]–[536].”
Survey on the Usage of Machine Learning Techniques for Malware Analysis (2017, background): “[29] survey papers that use machine learning techniques for malware analysis and only distinguish between malware detection and family classication.”
Dynamic Malware Analysis in the Modern Era—A State of the Art Survey (2019, background): “Although surveys in the domain of malware analysis have been performed in the past, they are either out of date or narrow in scope (e.g., focused on the difference between static and dynamic analysis [2–4]).”
A Comprehensive Review on Malware Detection Approaches (2020, methodology): “ML algorithms have been used in malware detection for many years [28].”
A Survey on Malware Detection Using Data Mining Techniques (2017, methodology): “Various techniques, such as autostart extensibility points, function parameter analysis, function call monitoring, information flow tracking, and instruction traces can be applied to perform dynamic analysis [Egele et al. 2012; Gandotra et al. 2014].”