Malware Behavior Extracting via Maximal Patterns

With the prevailing of malware, it is necessary to describe mal-program´s behavior in an efficient way. In this paper, a malware behavior extracting system is addressed. It used Intel VT to trace malware´s runtime system calls and extracted maximal patterns to describe malware behavior. A pattern´s extracting algorithm is proposed to extract maximal patterns from system calls sequence. Real-world malwares are used to validate this method. The results of experiments have shown that the method can describe the behavior of mal-program with strong resilience and high accuracy.