Malware Detection using the Context of API Calls

The widespread use of internet had been a source of gateway to release new malware variants into multiple systems. The intruders develop smart malicious code and pose a constant threat to the evolving malware detection techniques. The malware highly resemble the benign code by using the same set of instructions. This allows the malware to evade the detection framework. We can understand from this that the difference between malicious and benign code is not in the instructions that they utilize but how they are used. The context with which they are utilized plays a vital role in differentiating the malware and benign code. In this work we proposed an approach of defining and extracting the context of API calls obtained from the Portable Executable files of the Windows operating system. We have then selected class features using the Jaccard Index and applied various machine learning algorithms. The experimental results demonstrate that various types of classifiers have good accuracy in distinguishing malware and benign programs.