Cryptomining Malware Early Detection Method Based on AECD Embedding
Cryptomining malware can compromise system security, reduce hardware lifetime, and cause significant power consumption. Therefore, implementing cryptomining malware early detection to stop its damage in time is critical to system security. The existing dynamic analysis-based cryptomining malware ear...
| Main Author: | |
|---|---|
| Format: | Article |
| Language: | zho |
| Published: |
Journal of Computer Engineering and Applications Beijing Co., Ltd., Science Press
2024-04-01
|
| Series: | Jisuanji kexue yu tansuo |
| Subjects: | |
| Online Access: | http://fcst.ceaj.org/fileup/1673-9418/PDF/2307023.pdf |
| _version_ | 1797230970860994560 |
|---|---|
| author | CAO Chuanbo, GUO Chun, LI Xianchao, SHEN Guowei |
| author_facet | CAO Chuanbo, GUO Chun, LI Xianchao, SHEN Guowei |
| author_sort | CAO Chuanbo, GUO Chun, LI Xianchao, SHEN Guowei |
| collection | DOAJ |
| description | Cryptomining malware can compromise system security, reduce hardware lifetime, and cause significant power consumption. Therefore, implementing cryptomining malware early detection to stop its damage in time is critical to system security. The existing dynamic analysis-based cryptomining malware early detection methods are hard to balance the timeliness and accuracy of detection. To detect cryptomining malware accurately and timely, this paper integrates a certain length of API (application programming interface) names, API operation categories and DLLs (dynamic link libraries) called by cryptomining malware in the early stage of operation to more fully describe its behavioral information in this stage, and proposes the AECD (API embedding based on category and DLL) embedding and further proposes a cryptomining malware early detection method based on AECD embedding (CEDMA). CEDMA uses the API sequence called by software in the early stage of operation as the object of detection and uses AECD embedding and TextCNN (text convolutional neural network) to build a detection model to implement cryptomining malware early detection. Experimental results show that when CEDMA takes the 3000 API sequence called for the first time after the software runs as input, it can detect the known and unknown cryptomining malware samples in the experiment with 98.21% and 96.76% accuracy values, respectively. |
| first_indexed | 2024-04-24T15:36:57Z |
| format | Article |
| id | doaj.art-04543cde18044901adeba68c3eb4544a |
| institution | Directory Open Access Journal |
| issn | 1673-9418 |
| language | zho |
| last_indexed | 2024-04-24T15:36:57Z |
| publishDate | 2024-04-01 |
| publisher | Journal of Computer Engineering and Applications Beijing Co., Ltd., Science Press |
| record_format | Article |
| series | Jisuanji kexue yu tansuo |
| spelling | doaj.art-04543cde18044901adeba68c3eb4544a2024-04-02T01:27:22ZzhoJournal of Computer Engineering and Applications Beijing Co., Ltd., Science PressJisuanji kexue yu tansuo1673-94182024-04-011841083109310.3778/j.issn.1673-9418.2307023Cryptomining Malware Early Detection Method Based on AECD EmbeddingCAO Chuanbo, GUO Chun, LI Xianchao, SHEN Guowei01. State Key Laboratory of Public Big Data, College of Computer Science and Technology, Guizhou University, Guiyang 550025, China 2. Guizhou Xiangming Technology Co., Ltd., Guiyang 550025, ChinaCryptomining malware can compromise system security, reduce hardware lifetime, and cause significant power consumption. Therefore, implementing cryptomining malware early detection to stop its damage in time is critical to system security. The existing dynamic analysis-based cryptomining malware early detection methods are hard to balance the timeliness and accuracy of detection. To detect cryptomining malware accurately and timely, this paper integrates a certain length of API (application programming interface) names, API operation categories and DLLs (dynamic link libraries) called by cryptomining malware in the early stage of operation to more fully describe its behavioral information in this stage, and proposes the AECD (API embedding based on category and DLL) embedding and further proposes a cryptomining malware early detection method based on AECD embedding (CEDMA). CEDMA uses the API sequence called by software in the early stage of operation as the object of detection and uses AECD embedding and TextCNN (text convolutional neural network) to build a detection model to implement cryptomining malware early detection. Experimental results show that when CEDMA takes the 3000 API sequence called for the first time after the software runs as input, it can detect the known and unknown cryptomining malware samples in the experiment with 98.21% and 96.76% accuracy values, respectively.http://fcst.ceaj.org/fileup/1673-9418/PDF/2307023.pdfcryptomining malware; dynamic analysis; early detection; deep learning |
| spellingShingle | CAO Chuanbo, GUO Chun, LI Xianchao, SHEN Guowei Cryptomining Malware Early Detection Method Based on AECD Embedding Jisuanji kexue yu tansuo cryptomining malware; dynamic analysis; early detection; deep learning |
| title | Cryptomining Malware Early Detection Method Based on AECD Embedding |
| title_full | Cryptomining Malware Early Detection Method Based on AECD Embedding |
| title_fullStr | Cryptomining Malware Early Detection Method Based on AECD Embedding |
| title_full_unstemmed | Cryptomining Malware Early Detection Method Based on AECD Embedding |
| title_short | Cryptomining Malware Early Detection Method Based on AECD Embedding |
| title_sort | cryptomining malware early detection method based on aecd embedding |
| topic | cryptomining malware; dynamic analysis; early detection; deep learning |
| url | http://fcst.ceaj.org/fileup/1673-9418/PDF/2307023.pdf |
| work_keys_str_mv | AT caochuanboguochunlixianchaoshenguowei cryptominingmalwareearlydetectionmethodbasedonaecdembedding |