Detecting Malware Activities With MalpMiner: A Dynamic Analysis Approach

Day by day, malware as a service becomes more popular and easy to acquire, thus allowing anyone to start an attack without any technical background, which in turn introduces challenges for detecting such attacks. One of those challenges is the detection of malware activities early to prevent harm as much as possible. This paper presents a trusted dynamic analysis approach based on Answer Set Programming (ASP), a logic engine inference named Malware-Logic-Miner (MalpMiner). ASP is a nonmonotonic reasoning engine built on an open-world assumption, which allows MalpMiner to adopt commonsense reasoning when capturing malware activities of any given binary. Furthermore, MalpMiner requires no prior training; therefore, it can scale up quickly to include more malware-attack attributes. Moreover, MalpMiner considers the invoked application programming interfaces' values, resulting in correct malware behaviour modelling. The baseline experiments prove the correctness of MalpMiner related to recognizing malware activities. Moreover, MalpMiner achieved a detection ratio of 99% with a false-positive rate of less than 1% while maintaining low computational costs and explaining the detection decision.