SeqShield uses API call sequences to detect elusive rootkits

Researchers have developed SeqShield, a novel approach for detecting rootkits on Windows systems by analyzing sequences of API calls. This behavior-based method moves beyond traditional signature detection, which struggles with metamorphic malware. SeqShield extracts features from API call sequences using n-gram analysis and employs machine learning models, with Random Forest achieving over 97% accuracy. The system also uses feature importance ranking to optimize detection efficiency. AI

IMPACT Enhances security tools by providing a more robust method for detecting sophisticated malware like rootkits.

RANK_REASON Academic paper detailing a new method for malware detection.

Read on arXiv cs.LG →

• arXiv
• Gini Impurity Index
• Windows
• Random Forest
• SeqShield

• paper
• safety

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →