As malware illustrates a complex structure and behavior, detection of these has been a significant challenge in the domain of cybersecurity along with related services in daily life. So, it becomes crucial to have a reliable and adaptive solution to address the issue. Among the several detection methods developed over the years, one of the most reliable ones is studying and analyzing the structural and behavioral patterns of malware. These patterns of sophisticated malware can be obtained with the help of Function Call Graphs (FCGs). However, to effectively cover numerous groups of families of malware, it is required to have a sufficiently large dataset for the system to operate on. In order to ensure accuracy and robustness of the system, the dataset should comprise samples of different malwares and a benign application for secure execution of the detection process. This paper introduces AMD-FCG, an enhanced Function Call Graph dataset integrated with topological features of malwares. The framework enhances the detection procedure, streamlining the workflow for cybersecurity professionals and also eliminating the need for dynamic analysis and extensive processing. Therefore, it can be used to develop and deploy more efficient and innovative malware detection systems.
翻译:随着恶意软件展现出复杂的结构与行为特征,其检测已成为网络安全领域及日常相关服务中的重大挑战。因此,开发可靠且自适应的解决方案至关重要。在历年研发的多种检测方法中,研究分析恶意软件的结构与行为模式是最可靠的方式之一。借助函数调用图(FCG)可获取这些复杂恶意软件的模式特征。然而,为有效覆盖多类恶意软件家族,系统需依托足够规模的数据库运行。为确保检测过程的准确性与鲁棒性,数据集应包含不同恶意软件样本及良性应用程序样本。本文提出AMD-FCG——一种融合恶意软件拓扑特征的增强型函数调用图数据集。该框架优化了检测流程,简化了网络安全专业人员的工作路径,同时消除了动态分析与大量预处理的需求,从而可用于开发部署更高效、更创新的恶意软件检测系统。