Vol.3, No.2, 2021, pp.55-63, doi:10.32604/jqc.2021.017365
Malware Detection Based on Multidimensional Time Distribution Features
  • Huizhong Sun1, Guosheng Xu1,*, Hewei Yu2, Minyan Ma3, Yanhui Guo1, Ruijie Quan4
1 School of Cyberspace Security, Beijing University of Posts and Telecommunication, Beijing, China
2 Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC), Beijing, China
3 Zhejiang Branch of National Computer Network Emergency Response Technical Team/Coordination Center of China, Hangzhou, China
4 Faculty of Engineering and Information Technology, University of Technology Sydney, Sydney, Australia
* Corresponding Author: Guosheng Xu. Email:
Received 16 March 2021; Accepted 26 May 2021; Issue published 22 June 2021
Language detection models based on system calls suffer from certain false negatives and detection blind spots. Hence, the normal behavior sequences of some malware applications for a short period can become malicious behavior within a certain time window. To detect such behaviors, we extract a multidimensional time distribution feature matrix on the basis of statistical analysis. This matrix mainly includes multidimensional time distribution features, multidimensional word pair correlation features, and multidimensional word frequency distribution features. A multidimensional time distribution model based on neural networks is built to detect the overall abnormal behavior within a given time window. Experimental evaluation is conducted using the ADFA-LD dataset. Accuracy, precision, and recall are used as the measurement indicators of the model. An accuracy rate of 95.26% and a recall rate of 96.11% are achieved.
System call; sequence; malware; neural network
Cite This Article
. , "Malware detection based on multidimensional time distribution features," Journal of Quantum Computing, vol. 3, no.2, pp. 55–63, 2021.
This work is licensed under a Creative Commons Attribution 4.0 International License , which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.