Import API sequences analysis for malware classification

Abstract

In recent years, the amount of new malware discovered every day is increasing continuously, because the automated tools allow attackers to easily generate new malware or its variants. However, current anti-virus software relies heavily on malware signatures, and signature-based malware detection and classification methods have some limitations. In addition, much time and efforts are required in order to extract the signatures from various malware samples. Therefore, a rapid malware analysis method is required in order to mitigate the infection rate and secondary damages to users. In this paper, we analyzed import API sequences to classify the malware, and described experimental results against some malware samples. Malware classification techniques can reduce the size of malware search domains, and as a result it can improve malware analysis.