Behavior-based Detection Method Research Articles

Malware Analysis Using Memory Forensics

Abstract: Malware is still the most dangerous issue facing internet users in today's online environment. The newly created malware is separate from the traditional kind, has a more dynamic design, and typically combines traits from two or more different malware types. comparing the various memory acquisition tools that are available, each of which has a varying performance dependent on the setups, installed hardware, and operating system version. If the ending character is not present. To address the growing malware issue, new methodologies like machine learning must be employed. Investigate how cybersecurity is used in this study for malware detection and machine learning. In this study will look at the PE (portable executable) headers of malware and non-malware samples in order to build a malware classifier that can identify if malware is there or not. The development of behavior-based malware detection and classification methods using various machine learning approaches is addressed in this study along with behavior-based detection methods itself

Advanced Intrusion Detection Combining Signature-Based and Behavior-Based Detection Methods

Recently, devices in real-time systems, such as residential facilities, vehicles, factories, and social infrastructure, have been increasingly connected to communication networks. Although these devices provide administrative convenience and enable the development of more sophisticated control systems, critical cybersecurity concerns and challenges remain. In this paper, we propose a hybrid anomaly detection method that combines statistical filtering and a composite autoencoder to effectively detect anomalous behaviors possibly caused by malicious activity in order to mitigate the risk of cyberattacks. We used the SWaT dataset, which was collected from a real water treatment system, to conduct a case study of cyberattacks on industrial control systems to validate the performance of the proposed approach. We then evaluated the performance of the proposed hybrid detection method on a dataset with two time window settings for the composite autoencoder. According to the experimental results, the proposed method improved the precision, recall, and F1-score by up to 0.008, 0.067, and 0.039, respectively, compared to an autoencoder-only approach. Moreover, we evaluated the computational cost of the proposed method in terms of execution time. The execution time of the proposed method was reduced by up to 8.03% compared to that of an autoencoder-only approach. Through the experimental results, we show that the proposed method detected more anomalies than an autoencoder-only detection approach and it also operated significantly faster.

Malware Analysis Through Random Forest Approach

This paper gives precise and comprehensive detail along with a proposed system for malware detection using ML and Deep Learning techniques by integrating both behavior-based detection methods and signature-based methods. The primary purpose of this paper is (A) Outline difficulty identified with malware detection. (B) Represent detail and categorized ML technique for malware detection. (C) Investigating the structure of basic strategies in malware discovery. (D) Inspecting the essential deep learning approach for malware detection using a grouping of malware inside the data mining. The point of interest and downside of various malware detection approaches were analyzed based on evaluation strategy and their capability. The proposed model uses random forest for making an end-to-end pipeline for malware detection. During comparative study with five other state of the art models, the proposed model obtained accuracy of 99.7% on the dataset. The experimental results show the proposed model outperformed other five state of the art techniques. This research paper encourages the researcher to think about the best approach for malware detection.

Machine Learning Based File Entropy Analysis for Ransomware Detection in Backup Systems

With the advent of big data and cloud services, user data has become an important issue. Although a variety of detection and prevention technologies are used to protect user data, ransomware that demands money in exchange for one's data has emerged. In order to detect and prevent ransomware, file- and behavior-based detection methods have been investigated. Nevertheless, we are still facing from ransomware threats, as it is difficult to detect and prevent ransomware containing unknown malicious codes. In particular, these methods are limited in that they cannot detect ransomware for backup systems such as cloud services. For instance, if files infected with ransomware are synchronized with the backup systems, the infected files will not be able to be restored through the backed-up files. In this paper, we utilize an entropy technique to measure a characteristic of the encrypted file (i.e., uniformity). Machine learning is applied for classifying infected files based file entropy analysis. The proposed method can recover the original file from the backup system by detecting ransomware infected files that have been synchronized to the backup system, even if the user system is infected by ransomware. Conducted analysis results confirm that the proposed method provides a high detection rate with low false positive and false negative rates compared with the existing detection methods.

N-grams Based Supervised Machine Learning Model for Mobile Agent Platform Protection against Unknown Malicious Mobile Agents

From many past years, the detection of unknown malicious mobile agents before they invade the Mobile Agent Platform has been the subject of much challenging activity. The ever-growing threat of malicious agents calls for techniques for automated malicious agent detection. In this context, the machine learning (ML) methods are acknowledged more effective than the Signature-based and Behavior-based detection methods. Therefore, in this paper, the prime contribution has been made to detect the unknown malicious mobile agents based on n-gram features and supervised ML approach, which has not been done so far in the sphere of the Mobile Agents System (MAS) security. To carry out the study, the n-grams ranging from 3 to 9 are extracted from a dataset containing 40 malicious and 40 non-malicious mobile agents. Subsequently, the classification is performed using different classifiers. A nested 5-fold cross validation scheme is employed in order to avoid the biasing in the selection of optimal parameters of classifier. The observations of extensive experiments demonstrate that the work done in this paper is suitable for the task of unknown malicious mobile agent detection in a Mobile Agent Environment, and also adds the ML in the interest list of researchers dealing with MAS security.

Minimal contrast frequent pattern mining for malware detection

Currently, most of widely-used malware detection software products utilize signature-based algorithms to recognize threats. However, this approach is problematic because it relies on file hashes and byte (or instruction) signatures. Consequently, obfuscation techniques are straightforward ways to modify these features syntactically and evade detection. Since it is harder for an attacker to radically change the behavior of a malware than to morph its syntactic structure, behavior-based detection techniques are a promising solution to this problem. However behavior-based techniques can be applied using static analysis or dynamic analysis or hybrid analysis. While dynamic behavior-based detection methods are time consuming and fail to obtain all possible malicious execution traces, most of static behavior-based approaches suffer from a high growth rate in the number of behavioral signatures and suffer from high false positive rates. In this paper, we present a new graph mining method to detect variants of malware using static analysis, while covering the existing defects. We propose a novel algorithm, called minimal contrast frequent subgraph miner algorithm (MCFSM), for extracting minimal discriminative and widely employed malicious behavioral patterns which can identify precisely an entire family of malicious programs, in contrast to another set of benign programs. The proposed method shows high detection rates and low false positive rates and generates a limited number of behavioral malware signatures.

Growing Grapes in Your Computer to Defend Against Malware

Behavior-based detection is promising to resolve the pressing security problem of malware. However, the great challenge lies in how to detect malware in a both accurate and light-weight manner. In this paper, we propose a novel behavior-based detection method, named growing grapes, aiming to enable accurate online detection. It consists of a clustering engine and detection engine. The clustering engine groups the objects, e.g., processes and files, of a suspicious program together into a cluster, just like growing grapes. The detection engine recognizes the cluster as malicious if the behaviors of the cluster match a predefined behavior template formed by a set of discrete behaviors. The approach is accurate since it identifies a malware based on multiple behaviors and the source of the processes requesting the behaviors. The approach is also light-weight as it uses OS-level information flows instead of data flows that generally impose significant performance impact on the system. To further improve the performance, a novel method of organizing the behavior template and template database is proposed, which not only makes the template matching process very quick, but also makes the storage space small and fixed. Furthermore, the detection accuracy and performance are optimized to the best degree using a combinatorial optimization algorithm, which properly selects and combines multiple behaviors to form a template for malware detection. Finally, the approach novelly identifies malicious OS objects in a cluster fashion rather than one by one as done in traditional methods, which help users to thoroughly eliminate the changes of a malware without malware family knowledge. Compared with commercial antimalware tools, extensive experiments show that our approach can detect new malware samples with higher detection rate and lower false positive rate while imposing low overhead on the system.

Reviews on Cybercrime Affecting Portable Devices

Abstract The popularity of mobile devices in the market is impressive, but this influx of different products has made it difficult for users to secure their infrastructures from potential data breaches. As the number of exposures and attacks increase, there has been a corresponding rise in security solutions offered by researchers. This article reviews the literature to prevent the cybercrime affecting portable devices especially smartphones running Android OS. Extant researches are analyzed and opportunities for future research are identified. Four research questions have been developed and out of 493 articles retrieved, 33 articles have been selected to be analyzed. From the analysis, we have found that Data leakage resulting from device loss or theft, unintentional disclosure of data and phishing attacks are most common between attackers. With no doubt, security investigators have stressed the grandness of protecting classified personal data residing in Android portable devices. They have suggested to use the permission-based security model and behavior-based detection method for protecting classified information. In result we found that Android OS can handle and apply the integrated protection model but still there are opportunities for us to improve the security of personal data.

Virus Detection Method based on Behavior Resource Tree

Due to the disadvantages of signature-based computer virus detection techniques, behavior-based detection methods have developed rapidly in recent years. However, current popular behavior-based detection methods only take API call sequences as program behavior features and the difference between API calls in the detection is not taken into consideration. This paper divides virus behaviors into separate function modules by introducing DLLs into detection. APIs in different modules have different importance. DLLs and APIs are both considered program calling resources. Based on the calling relationships between DLLs and APIs, program calling resources can be pictured as a tree named program behavior resource tree. Important block structures are selected from the tree as program behavior features. Finally, a virus detection model based on behavior the resource tree is proposed and verified by experiment which provides a helpful reference to virus detection.