A Comparison of Static, Dynamic, and Hybrid Analysis for Malware Detection

Abstract

In this research, we compare malware detection techniques based on static, dynamic, and hybrid analysis. Specifically, we train Hidden Markov Models (HMMs ) on both static and dynamic feature sets and compare the resulting detection rates over a substantial number of malware families. We also consider hybrid cases, where dynamic analysis is used in the training phase, with static techniques used in the detection phase, and vice versa. In our experiments, a fully dynamic approach generally yields the best detection rates. We discuss the implications of this research for malware detection based on hybrid techniques.

Cited by in corpus (21)

• Survey of Machine Learning Techniques for Malware Analysis
• Early Stage Malware Prediction Using Recurrent Neural Networks
• A Survey of Malware Detection Using Deep Learning
• Self-Supervised Vision Transformers for Malware Detection
• I-MAD: Interpretable Malware Detector Using Galaxy Transformer
• Explainable Artificial Intelligence (XAI) for Malware Analysis: A Survey of Techniques, Applications, and Open Challenges
• Creating Valid Adversarial Examples of Malware
• MalBERT: Using Transformers for Cybersecurity and Malicious Software Detection
• Dynamic Malware Analysis with Feature Engineering and Feature Learning
• Tools and Techniques for Malware Detection and Analysis
• SourceFinder: Finding Malware Source-Code from Publicly Available Repositories
• Heterogeneous Graph Matching Networks
• Benchmark of Data Preprocessing Methods for Imbalanced Classification
• Malware Detection at the Microarchitecture Level using Machine Learning Techniques
• Learning from Context: Exploiting and Interpreting File Path Information for Better Malware Detection
• A Comparative Analysis of Android Malware
• Transferable Cost-Aware Security Policy Implementation for Malware Detection Using Deep Reinforcement Learning
• Trace of the Times: Rootkit Detection through Temporal Anomalies in Kernel Activity
• Comparative Review of Malware Analysis Methodologies
• Malware Classification Using Deep Boosted Learning
• Malicious Software Detection and Classification utilizing Temporal-Graphs of System-call Group Relations