Method of unknown virus detection based on analysis of Win32 API behaviors
Shuai Liu · Computer Engineering and Applications Journal · 2011
In view of the current behavior-based unknown virus detection methods need to run executable programs and can't detect static virus such as dropper,the static method based on Win32 API behaviors for detecting unknown virus is proposed.Firstly parsing PE files to extract the sensitive Win32 API calls,then classifying the API functions based on malicious behavior and conducting a fixed dimension characteristic behavior vector into a database.With the feature extraction method of minimizing discriminant entropy,the redundant feature items are reduced,finally the improved K-Nearest Neighbor(KNN) algorithm is used to classify.The experiment results show that the method has a high hit rate and lower missing rate,suitable for unknown virus detection in Cloud Security system.