Malware Detection and Classification Based on Parallel Sequence Comparison

Abstract

The traditional signature-based malware detection technology, which restricted by the updating frequency of the feature dataset, that cannot identify the new malware sample quickly. Malware from same type or same family usually have similar behaviors. Therefore, by comparing the similarity between the sequences represented by the function call sequence, which is less affected by the update frequency of the feature dataset. However, in face of a large number of malicious code samples to be detected, the size of the sequences extracted from the samples increases exponentially, which cannot guarantee the real-time detection of malware. In order to ensure the real time of malicious code detection, a parallel method based malicious code sequence comparison model is proposed in this paper. It includes two levels of parallelism, representing parallelism of different granularity, which effectively improves the efficiency of malicious code detection and recognition. The evaluation shows that our method has high effectiveness and efficiency with the large-scale data sets.