MemAPIDet: A Novel Memory-resident Malware Detection Framework Combining API Sequence and Memory Features

Memory-resident malware has become a huge threat to cybersecurity. They perform malicious operations only in memory and are difficult to detect by existing technologies. Existing malware detection solutions fail to effectively extract API sequence’s semantic features and memory data features related to malicious behaviors in memory dumps. This research paper presents a novel detection framework to address these limitations. It first extracts intrinsic semantic features of API sequences from memory data using a fine-tuned BERT, then extracts executable data features from memory dumps using a pre-trained ResNet34 neural network. It then splices the two features to train a deep neural network-based detection model. We created a high-quality dataset with 2180 benign programs and 1897 recent memory-resident malware samples. We implement MemAPIDet for Windows 10. It performs better than the state-of-the-art methods with a prediction accuracy of 97.78%