Open Access iconOpen Access



An Effective Memory Analysis for Malware Detection and Classification

Rami Sihwail*, Khairuddin Omar, Khairul Akram Zainol Ariffin

Department of Information Science & Technology, Universiti Kebangsaan Malaysia, Selangor, 43600, Malaysia

* Corresponding Author: Rami Sihwail. Email: email

Computers, Materials & Continua 2021, 67(2), 2301-2320.


The study of malware behaviors, over the last years, has received tremendous attention from researchers for the purpose of reducing malware risks. Most of the investigating experiments are performed using either static analysis or behavior analysis. However, recent studies have shown that both analyses are vulnerable to modern malware files that use several techniques to avoid analysis and detection. Therefore, extracted features could be meaningless and a distraction for malware analysts. However, the volatile memory can expose useful information about malware behaviors and characteristics. In addition, memory analysis is capable of detecting unconventional malware, such as in-memory and fileless malware. However, memory features have not been fully utilized yet. Therefore, this work aims to present a new malware detection and classification approach that extracts memory-based features from memory images using memory forensic techniques. The extracted features can expose the malware’s real behaviors, such as interacting with the operating system, DLL and process injection, communicating with command and control site, and requesting higher privileges to perform specific tasks. We also applied feature engineering and converted the features to binary vectors before training and testing the classifiers. The experiments show that the proposed approach has a high classification accuracy rate of 98.5% and a false positive rate as low as 1.24% using the SVM classifier. The efficiency of the approach has been evaluated by comparing it with other related works. Also, a new memory-based dataset consisting of 2502 malware files and 966 benign samples forming 8898 features and belonging to six memory types has been created and published online for research purposes.


Cite This Article

APA Style
Sihwail, R., Omar, K., Ariffin, K.A.Z. (2021). An effective memory analysis for malware detection and classification. Computers, Materials & Continua, 67(2), 2301-2320.
Vancouver Style
Sihwail R, Omar K, Ariffin KAZ. An effective memory analysis for malware detection and classification. Comput Mater Contin. 2021;67(2):2301-2320
IEEE Style
R. Sihwail, K. Omar, and K.A.Z. Ariffin "An Effective Memory Analysis for Malware Detection and Classification," Comput. Mater. Contin., vol. 67, no. 2, pp. 2301-2320. 2021.


cc This work is licensed under a Creative Commons Attribution 4.0 International License , which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
  • 3267


  • 2538


  • 0


Share Link