Toward Detecting Malware Based on Process-Aware Behaviors

Table 1

Comparison with related works.

Approach	Feature	Model	Description
[15]	API call sequence	RF, SVM, and DNNs	Considering only the sequence of APIcalls in dynamic behavioral featureslimits malware detection performance
[5]
[6]	API calls and arguments	Gated-CNN and LSTM	The use of raw run-time argumentsintroduces time and space consumption
[3]	API calls and arguments	Text-CNN and Bi-LSTM	API labelling reduces resource consumption, but lacks the perception of behavioral relationships between processes
[16]	Process activities and trees	ML-based method	Analysis of process relationships but lack of correlation analysis with specific actions performed within processes
[9]
[10]
[17]	File, process, network, and	ML-based and	Multiple complex full-behavior data increases the difficulty of analysis, and extra cting key behavioral information from the large amount of redundant data is difficult
[18]	OS-level behaviors	Cluster method