Instrumenting API Hooking for a Realtime Dynamic Analysis

There are various approaches to detect malware. Among them is via dynamic analysis which is a very essential technique capable of detecting unknown malware. The dynamic analysis monitors the behaviour of the executable by providing its execution behaviour information. Since the complexity of the malware is increasing, it is important to monitor the malware and study how malware behaves to help in detecting it. In this paper, we highlighted the instrumentation technique to observe behaviour of Portable Executable execution. We briefly explored some of the related works. We discussed about dynamic analysis and Windows API Calls. We discussed on our realtime behaviour monitor. The concept of n-gram was explained and before concluding, several challenges were highlighted.