Raducu, Razvan; Rodríguez, Ricardo J.; Álvarez, Pedro
A Graph-Based Dynamic Analysis System for Behavior Detection in Windows Applications Journal Article
In: The Computer Journal, 2026, (Accepted for publication. To appear.).
Abstract | Links | BibTeX | Tags: behavior graphs, call graphs, category graphs, Dynamic Analysis, malware, Windows
@article{Raducu2026,
title = {A Graph-Based Dynamic Analysis System for Behavior Detection in Windows Applications},
author = {Razvan Raducu and Ricardo J. Rodríguez and Pedro Álvarez},
url = {https://webdiis.unizar.es/~ricardo/files/papers/RaducuRA-COMPJ-26.pdf},
year = {2026},
date = {2026-01-01},
journal = {The Computer Journal},
publisher = {Oxford University Press},
abstract = {The increasing sophistication of malicious software (em malware) requires advanced tools to effectively analyze and counter threats. In this paper, we present sc MalGraphIQ, a dynamic analysis system designed to understand the behavior of unknown Windows binaries by introducing the em Windows Behavior Catalog (WBC). The WBC is a new repository of behavioral patterns inspired by MITRE's Malware Behavior Catalog (MBC), which systematically catalogs key APIs and system calls used by Windows binaries to exhibit specific behaviors. By leveraging sandbox technologies (specifically, CAPEv2), our dynamic analysis system uses the WBC to detect and quantify behaviors in programs, regardless of whether they are malicious or benign. It also generates graph-based visual representations of these behaviors, simplifying the interpretation of the actions performed by the program. To evaluate its effectiveness, we apply our system to multiple malware families and validate the results using cross-validation, demonstrating its ability to uncover specific actions and behavioral patterns across different malware samples and unknown binaries. The results show the system’s ability to detect behavioral patterns and distinguish between different types of malware, with an accuracy of up to 0.96 and an F1 score of 0.92, underlining the potential of our approach in malware detection and program behavioral analysis.},
note = {Accepted for publication. To appear.},
keywords = {behavior graphs, call graphs, category graphs, Dynamic Analysis, malware, Windows},
pubstate = {published},
tppubtype = {article}
}
The increasing sophistication of malicious software (em malware) requires advanced tools to effectively analyze and counter threats. In this paper, we present sc MalGraphIQ, a dynamic analysis system designed to understand the behavior of unknown Windows binaries by introducing the em Windows Behavior Catalog (WBC). The WBC is a new repository of behavioral patterns inspired by MITRE's Malware Behavior Catalog (MBC), which systematically catalogs key APIs and system calls used by Windows binaries to exhibit specific behaviors. By leveraging sandbox technologies (specifically, CAPEv2), our dynamic analysis system uses the WBC to detect and quantify behaviors in programs, regardless of whether they are malicious or benign. It also generates graph-based visual representations of these behaviors, simplifying the interpretation of the actions performed by the program. To evaluate its effectiveness, we apply our system to multiple malware families and validate the results using cross-validation, demonstrating its ability to uncover specific actions and behavioral patterns across different malware samples and unknown binaries. The results show the system’s ability to detect behavioral patterns and distinguish between different types of malware, with an accuracy of up to 0.96 and an F1 score of 0.92, underlining the potential of our approach in malware detection and program behavioral analysis.
Carrillo-Mondéjar, Javier; Suárez-Tangil, Guillermo; Costin, Andrei; Rodríguez, Ricardo J.
Exploring Shifting Patterns in Recent IoT Malware Proceedings Article
In: Proceedings of the 23rd European Conference on Cyber Warfare and Security (ECCWS), pp. 96–106, ACI, 2024.
Abstract | Links | BibTeX | Tags: Dynamic Analysis, Malware Evolution, Malware IoT, Malware lineage, Static Analysis
@inproceedings{CSCR-ECCWS-24b,
title = {Exploring Shifting Patterns in Recent IoT Malware},
author = {Javier Carrillo-Mondéjar and Guillermo Suárez-Tangil and Andrei Costin and Ricardo J. Rodríguez},
url = {http://webdiis.unizar.es/~ricardo/files/papers/CSCR-ECCWS-24.pdf},
doi = {10.34190/eccws.23.1.2280},
year = {2024},
date = {2024-07-01},
booktitle = {Proceedings of the 23rd European Conference on Cyber Warfare and Security (ECCWS)},
volume = {23},
number = {1},
pages = {96–106},
publisher = {ACI},
abstract = {The rise of malware targeting interconnected infrastructures has surged in recent years, driven largely by the widespread presence of vulnerable legacy IoT devices and inadequately secured networks. Despite the strong interest attackers have in targeting this infrastructure, a significant gap remains in understanding how the landscape has recently evolved. Addressing this knowledge gap is essential to thwarting the proliferation of massive botnets, thereby safeguarding end-users and preventing disruptions in critical infrastructures. This work offers a contemporary analysis of Linux-based malware, specifically tailored to IoT malware operating in 2021-2023. Using automated techniques involving both static and dynamic analysis, we classify malware into related threats. By scrutinizing the most recent dataset of Linux-based malware and comparing it to previous studies, we unveil distinctive insights into emerging trends, offering an unparalleled understanding of the evolving landscape. Although Mirai and Gafgyt remain the most prominent families and present a large number of variants, our results show that (i) there is an increase in the sophistication of malware, (ii) malware authors are adding new exploits to their arsenal, and (iii) malware families that originally attacked Windows systems have been adapted to attack Linux-based devices.},
keywords = {Dynamic Analysis, Malware Evolution, Malware IoT, Malware lineage, Static Analysis},
pubstate = {published},
tppubtype = {inproceedings}
}
The rise of malware targeting interconnected infrastructures has surged in recent years, driven largely by the widespread presence of vulnerable legacy IoT devices and inadequately secured networks. Despite the strong interest attackers have in targeting this infrastructure, a significant gap remains in understanding how the landscape has recently evolved. Addressing this knowledge gap is essential to thwarting the proliferation of massive botnets, thereby safeguarding end-users and preventing disruptions in critical infrastructures. This work offers a contemporary analysis of Linux-based malware, specifically tailored to IoT malware operating in 2021-2023. Using automated techniques involving both static and dynamic analysis, we classify malware into related threats. By scrutinizing the most recent dataset of Linux-based malware and comparing it to previous studies, we unveil distinctive insights into emerging trends, offering an unparalleled understanding of the evolving landscape. Although Mirai and Gafgyt remain the most prominent families and present a large number of variants, our results show that (i) there is an increase in the sophistication of malware, (ii) malware authors are adding new exploits to their arsenal, and (iii) malware families that originally attacked Windows systems have been adapted to attack Linux-based devices.