Anomaly detection with machine learning models using API calls

Basit Öğe Kaydı
dc.authorscopusidSedat Akyelek / 15833929800
dc.contributor.authorŞahin, Varol
dc.contributor.authorSatılmış, Hami
dc.contributor.authorYazar, Bilge Kağan
dc.contributor.authorAkleylek, Sedat
dc.date.accessioned2025-04-18T06:21:23Z
dc.date.available2025-04-18T06:21:23Z
dc.date.issued2025
dc.departmentİstinye Üniversitesi, Mühendislik ve Doğa Bilimleri Fakültesi, Bilgisayar Mühendisliği Bölümü
dc.description.abstractMalware is malicious code developed to damage telecommunications and computer systems. Many malware causes anomaly events, such as occupying the systems’ resources, such as CPU and memory, or preventing their use. Malware causing these events can hide their destructive activities. Therefore, monitoring their behavior to detect and block such malicious software is necessary. In other words, the anomalies they cause are detected and intervened by monitoring the behaviors exhibited by malware. Various features such as application programming interface (API) calls or system calls, registry modification, and network activities constitute malware behavior. API calls and various statistical information of these calls, extracted by dynamic analysis, are considered one of the most representative features of behavior-based detection systems. Each API call in the sequences is associated with previous or subsequent API calls. Such relationships may contain patterns of destructive functions of malware. Many intrusion/anomaly detection systems are proposed, including machine and deep learning models, in which various information about API/system calls are used as features. This paper aims to evaluate the effect of various statistical information of API calls on the models in detecting anomaly events and classification performances. The anomaly detection performances of various machine learning (ML) models with known effects in the literature are examined using a dataset containing API calls. As a result of the experiments, it is seen that the models using statistical features of API calls have reached high performance in terms of precision, recall, f1-score, and accuracy metrics.
dc.identifier.citationSahin, V., Satilmis, H., Yazar, B. K., & Akleylek, S. (2024, April). Anomaly Detection with Machine Learning Models Using API Calls. In International Conference on Information Technologies and Their Applications (pp. 298-309). Cham: Springer Nature Switzerland.
dc.identifier.doi10.1007/978-3-031-73420-5_25
dc.identifier.endpage309
dc.identifier.isbn978-303173419-9
dc.identifier.issn18650929
dc.identifier.scopus2-s2.0-85207825540
dc.identifier.scopusqualityQ3
dc.identifier.startpage298
dc.identifier.urihttp://dx.doi.org/10.1007/978-3-031-73420-5_25
dc.identifier.urihttps://hdl.handle.net/20.500.12713/6327
dc.identifier.volume2226
dc.indekslendigikaynakScopus
dc.institutionauthorAkleylek, Sedat
dc.institutionauthoridSedat Akyelek / 0000-0001-7005-6489
dc.language.isoen
dc.publisherSpringer science and business media deutschland GmbH
dc.relation.ispartofCommunications in computer and information science
dc.relation.publicationcategoryKonferans Öğesi - Uluslararası - Kurum Öğretim Elemanı
dc.rightsinfo:eu-repo/semantics/closedAccess
dc.subjectAnomaly Detection
dc.subjectAPI Call
dc.subjectComparative Analysis
dc.subjectDeep Learning
dc.subjectMachine Learning
dc.titleAnomaly detection with machine learning models using API calls
dc.typeConference Object

Dosyalar

Lisans paketi
Listeleniyor 1 - 1 / 1
Küçük Resim Yok
İsim:
license.txt
Boyut:
1.17 KB
Biçim:
Item-specific license agreed upon to submission
Açıklama:
İndir

Koleksiyon

Bilgisayar Mühendisliği Bölümü Bildiri Koleksiyonu