A Dynamic Malware Detection Method Based on an Evasive API Weighting Algorithm

In recent years, with the rapid development of digitization and Internet technology, the variety and quantity of malware are increasing, and the network security situation is becoming increasingly severe.Faced with the challenge of malware using advanced escape techniques, traditional dynamic detection methods are not accurate and sensitive enough.Therefore, we propose a dynamic malware detection method based on circumventing the API weighting algorithm to solve the above problems.Specifically, this paper studies the escape technology of malware using HOOK API to hide malicious behaviors, organizes the analysis of al-khaser, pafish and other escape samples, and proposes a weighting algorithm for typical escape APIs.The algorithm highlights the escape behavior and improves the sensitivity of the detection model by weighting the difference between the number of escape API calls in the normal environment and the sandbox environment.In addition, TF-IDF is used for feature extraction, effectively highlighting features that are important in a particular sample but uncommon across all samples.Finally, combining TF-IDF and Bi-LSTM models, the malware detection model is constructed to effectively extract features and classify them, which improves the accuracy and efficiency of detection.The experimental results show that the detection accuracy of this method on the Alibaba Cloud malware detection dataset reaches 91.26%.