Abstract: This paper presents a method to detect obfuscated system calls of malware. The idea is to use address stack and address stack graph to detect obfuscated system calls of malware. An address stack is used to associate each element in the stack to the instru

Key words: Malware, Obfuscated calls, Address stack, Address stack graph