SeqShield uses API call sequences to detect elusive rootkits

Researchers have developed SeqShield, a novel approach for detecting rootkits on Windows systems by analyzing sequences of API calls. This behavior-based method moves beyond traditional signature detection, which struggles with metamorphic malware. SeqShield extracts features from API call sequences using n-gram analysis and employs machine learning models, with Random Forest achieving over 97% accuracy. The system also uses feature importance ranking to optimize detection efficiency. AI

Summary written by gemini-2.5-flash-lite from 1 source. How we write summaries →

IMPACT Enhances security tools by providing a more robust method for detecting sophisticated malware like rootkits.

RANK_REASON Academic paper detailing a new method for malware detection.

Read on arXiv cs.LG →

• SeqShield
• Windows
• Random Forest
• Gini Impurity Index
• arXiv

• paper
• safety