通过系统调用分析识别恶意软件行为，提升检测精度。
System Calls for Malware Detection and Classification: Methodologies and Applications
- 结合动态分析与机器学习，捕捉程序运行时的系统调用模式。
- 在Windows、Linux和Android系统上验证了方法的有效性。
- 适用于反病毒研究者与安全工程师，对抗高级持续性威胁。
随着恶意软件日益复杂，传统检测手段面临挑战。本文深入探讨系统调用与API调用在恶意软件检测与分类中的应用，这些调用是用户程序与操作系统之间的核心交互方式，能揭示程序的行为特征。通过静态分析、动态分析及沙箱技术，结合机器学习、统计分析与异常检测，可有效区分正常与恶意行为。研究覆盖Windows、Linux和Android三大平台，并分析了高级恶意软件的规避策略，为构建更智能的恶意软件防御体系提供方法支持。
原文摘要 · Abstract (English)
As malware continues to become more complex and harder to detect, Malware Analysis needs to continue to evolve to stay one step ahead. One promising key area approach focuses on using system calls and API Calls, the core communication between user applications and the operating system and their kernels. These calls provide valuable insight into how software or programs behaves, making them an useful tool for spotting suspicious or harmful activity of programs and software. This chapter takes a deep down look at how system calls are used in malware detection and classification, covering techniques like static and dynamic analysis, as well as sandboxing. By combining these methods with advanced techniques like machine learning, statistical analysis, and anomaly detection, researchers can analyze system call patterns to tell the difference between normal and malicious behavior. The chapter also explores how these techniques are applied across different systems, including Windows, Linux, and Android, while also looking at the ways sophisticated malware tries to evade detection.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。