Angelo Cannarile
Research Subjects
Research Interests
Angelo Cannarile has a total of 5 co-authors. Here are the top co-authors by number of shared publications:
- Andrea Iannacone
BVTech SpA, 20123 Milano, Italy
1 shared publication - Donato Impedovo
Department of Computer Science, University of Bari Aldo Moro, Bari, Italy
1 shared publication - Giuseppe Pirlo
University of Bari Aldo Moro
1 shared publication - Stefano Galantucci
University of Foggia
1 shared publication - Vincenzo Dentamaro
University of Bari Aldo Moro
1 shared publication
Latest Publications
- Open Access
- 4 February 2022
- Published by MDPI AG in Applied Sciences
- Vol. 12 (3) , 1645
Comparing Deep Learning and Shallow Learning Techniques for API Calls Malware Prediction: A Study
Recognition of malware is critical in cybersecurity as it allows for avoiding execution and the downloading of malware. One of the possible approaches is to analyze the executable’s Application Programming Interface (API) calls, which can be done using tools that work in sandboxes, such as Cuckoo or CAPEv2. This chain of calls can then be used to classify if the considered file is benign or malware. This work aims to compare six modern shallow learning and deep learning techniques based on tabular data, using two datasets of API calls containing malware and goodware, where the corresponding chain of API calls is expressed for each instance. The results show the quality of shallow learning approaches based on tree ensembles, such as CatBoost, both in terms of F1-macro score and Area Under the ROC curve (AUC ROC), and training time, making them optimal for making inferences on Edge AI solutions. The results are then analyzed with the explainable AI SHAP technique, identifying the API calls that most influence the process, i.e., those that are particularly afferent to malware and goodware.
- 4 February 2022
- Published by MDPI AG in Applied Sciences
- Vol. 12 (3) , 1645
Open AccessComparing Deep Learning and Shallow Learning Techniques for API Calls Malware Prediction: A Study
Recognition of malware is critical in cybersecurity as it allows for avoiding execution and the downloading of malware. One of the possible approaches is to analyze the executable’s Application Programming Interface (API) calls, which can be done using tools that work in sandboxes, such as Cuckoo or CAPEv2. This chain of calls can then be used to classify if the considered file is benign or malware. This work aims to compare six modern shallow learning and deep learning techniques based on tabular data, using two datasets of API calls containing malware and goodware, where the corresponding chain of API calls is expressed for each instance. The results show the quality of shallow learning approaches based on tree ensembles, such as CatBoost, both in terms of F1-macro score and Area Under the ROC curve (AUC ROC), and training time, making them optimal for making inferences on Edge AI solutions. The results are then analyzed with the explainable AI SHAP technique, identifying the API calls that most influence the process, i.e., those that are particularly afferent to malware and goodware.