Dynamic behavior evaluation for malware detection

The number of malicious applications, their diversity and complexity is continuously growing. To provide the best protection against these advanced threats, there is a need to develop proactive detection solutions, that are able to detect malware based on their behavior. One of the essential concerns when developing such solutions is identifying specific actions based on which malicious applications will be detected. Almost all actions commonly performed by malware can also be encountered in the behavior of clean applications, making it necessary to develop a scoring engine able to evaluate the potential malicious behavior of a process, based on its entire set of actions. We propose a set of dynamic behavior evaluation concepts that should be considered by any proactive security researcher. Using these concepts we developed a scoring engine for a behavior-based solution that has a high detection rate, a small number of false positives, and is highly adaptable and extensible.