Providing a New Approach to Discovering Malware Behavioral Patterns Based on the Dependency Graph Between System Calls

Most malware producers use obfuscation techniques to bypass signature-based detections. In order to provide proactive and real-time protection, the researchers have begun to develop strategies for behavior-based detection. While behavior-based detection techniques are promising solutions to this growing problem of malwares varieties, but they still suffer from high false positive rate in detecting unknown malware detection. To overcome this problem, we shall seek for identifying patterns, representing malicious intent in all instances of a malware family. In this paper, we propose a new technique, based on discriminative subgraph mining technique to identify discriminative behavioral patterns. The malicious behavioral patterns discovered by our technique from a known malware set allows the detector to reach an 94% detection rate over unknown malware with no false positives. This is a significant improvement over the 55% detection rate observed from commercial antivirus, and the 86% rate reported by the best behavior-based detector.