AMD-FCG: An Enhanced Function Call Graph Dataset with Integrated Topological Features for Malware Detection and Classification
AMD-FCG:一个集成拓扑特征的增强函数调用图数据集,用于恶意软件检测与分类
Parthajit Borah, Sakshi Singh, D. K. Bhattacharyya, J. K. Kalita
AI总结 本文提出AMD-FCG数据集,通过集成恶意软件的拓扑特征增强函数调用图,以简化检测流程并消除动态分析需求,从而提升恶意软件检测的准确性和鲁棒性。
详情
由于恶意软件表现出复杂的结构和行为,其检测一直是网络安全领域及相关日常服务中的重大挑战。因此,拥有一个可靠且自适应的解决方案来解决该问题变得至关重要。在多年来开发的多种检测方法中,最可靠的方法之一是研究和分析恶意软件的结构和行为模式。这些复杂恶意软件的模式可以借助函数调用图(FCG)获得。然而,为了有效覆盖大量恶意软件家族群体,系统需要足够大的数据集来运行。为了确保系统的准确性和鲁棒性,数据集应包含不同恶意软件样本以及良性应用程序,以安全执行检测过程。本文介绍了AMD-FCG,一个集成恶意软件拓扑特征的增强函数调用图数据集。该框架增强了检测过程,简化了网络安全专业人员的工作流程,并消除了动态分析和大量处理的需求。因此,它可用于开发和部署更高效、更具创新性的恶意软件检测系统。
As malware illustrates a complex structure and behavior, detection of these has been a significant challenge in the domain of cybersecurity along with related services in daily life. So, it becomes crucial to have a reliable and adaptive solution to address the issue. Among the several detection methods developed over the years, one of the most reliable ones is studying and analyzing the structural and behavioral patterns of malware. These patterns of sophisticated malware can be obtained with the help of Function Call Graphs (FCGs). However, to effectively cover numerous groups of families of malware, it is required to have a sufficiently large dataset for the system to operate on. In order to ensure accuracy and robustness of the system, the dataset should comprise samples of different malwares and a benign application for secure execution of the detection process. This paper introduces AMD-FCG, an enhanced Function Call Graph dataset integrated with topological features of malwares. The framework enhances the detection procedure, streamlining the workflow for cybersecurity professionals and also eliminating the need for dynamic analysis and extensive processing. Therefore, it can be used to develop and deploy more efficient and innovative malware detection systems.