An Effective Method to Detect Environment-Aware Malware Based on the Behavioral Distances Comparison

Given the inefficiency of static analysis methods due to malware techniques such as code polymorphism, metamorphism, and obfuscation, and self-modifying code, leveraging dynamic and heuristic analysis   methods that are based on the analysis of runtime behavior of malwares, have become particularly important. Environment-aware malware that attempts to conceal its malicious behavior through dynamic anti-analysis methods has caused problems for dynamic analysis detection methods in practice. The purpose of this study is to present an effective method for environment-aware malware detection. Regarding to split–personality of such malware behaviors, this research has proposed an effective way to detect environment-aware malware. This method is based on system call monitoring of malicious and benign  samples under the two NtTrace and drstrace softwares with different monitoring techniques and calculating behavioral distances as training data to create a Support Vector Machine model. Finally, the resulted    support vector machine classifier is used to detect this type of malware with an average precision, recall and accuracy up to 100%, whereas the evaluation of previous related work shows an average precision, recall and accuracy 96.85%, 95.68% and 96.12%, respectively.