Ohana Means Family: Malware Family Classification using Extreme Learning Machines

Malwares have historically been the central threat concerning cybersecurity. With the rise in modern technologies, malwares have become more lethal due to the increasing connectivity between various computing environments. To exacerbate this increasing threat, modern day anti-virus signature matching seems to provide limited effectiveness, which makes it possible that new malware variants can evade detection when their behavior does not correlate exactly with known malware signatures on a system. There is also a wide time gap between when a new malware variant is released, and its corresponding antivirus signature is developed and made available to the public. This time gap is when these new malware variants can cause havoc on computing environments. To counteract this threat, the paper proposes a novel malware detection methodology to analyze and detect malware and classify malware by family. This is performed through time series analysis of the sequence of API calls made, using Extreme Learning Machines (ELM) and Online Sequential Extreme Learning Machines (OS-ELM). The paper further analyzes the approach by accurately detecting and predicting malware family classification using a subset of the API call sequences. Simulation results show that the proposed approach can accurately detect and classify malware families with higher accuracy and greater speed than traditional LSTM. Our experiments show ELM and OS-ELM performing with 91% accuracy within just 3 seconds of learning time in contrast to other methods. Thus, our method is superior both in terms of training time and accuracy.