Automatic Benchmark Generation Framework for Malware Detection

Box 1

3-gram of system call sequence.

NtOpenKey, NtQueryValueKey, NtClose, NtUserSetCursor, NtAllocateVirtualMemory, NtGdiHfontCreate

(a) System Call Sequence

(NtOpenKey, NtQueryValueKey, NtClose)

(NtQueryValueKey, NtClose, NtUserSetCursor)

(NtClose, NtUserSetCursor, NtAllocateVirtualMemory)

(NtUserSetCursor, NtAllocateVirtualMemory, NtGdiHfontCreate)

(b) 3-gram of Given Sequence