Dynamic Malware Analysis Research Articles

Dynamic Malware Analysis Using a Sandbox Environment, Network Traffic Logs, and Artificial Intelligence.

Dynamic Malware Analysis Using a Sandbox Environment, Network Traffic Logs, and Artificial Intelligence.

Dynamic Malware Analysis Using Machine Learning-Based Detection Algorithms

With the increasing popularity of cell phone use, the risk of malware infections on such devices has increased, resulting in financial losses for both individuals and organizations. Current research focuses on the application of machine learning for the detection and classification of these malware programs. Accordingly, the present work uses the frequency of system calls to detect and classify malware using the XGBoost, LightGBM and random forest algorithms. The highest results were obtained with the LightGBM algorithm, achieving 94,1 % precision and 93,9 % accuracy, recall, and F1-score, demonstrating the effectiveness of both machine learning and dynamic malware analysis in mitigating security threats on mobile devices.

IMPLEMENTATION OF DYNAMIC METHOD FOR MALWARE DETECTION IN EMAIL PHISHING ATTACKS ON LET'S DEFEND

In the rapidly evolving landscape of cybersecurity threats, the need for robust defenses against phishing attacks has become paramount. This study explores the efficacy of malware detection in phishing email attacks using dynamic analysis on the Letsdefend.io platform. Leveraging the insights provided by the Deloitte Center for Controllership regarding the escalating frequency of cyber adversaries targeting organizational data, this research investigates the effectiveness of the Letsdefend.io platform, particularly utilizing the SOC 146 rule, in identifying and mitigating phishing threats. Through a comprehensive analysis process encompassing dynamic malware analysis techniques, such as those employed by VirusTotal and URLHaus, alongside detailed examination of suspicious email attachments using the Mailbox feature, this study aims to provide insights into the evolving tactics of phishing attackers, specifically those utilizing Excel 4.0 Macros. The research methodology involves collecting malware samples for analysis, configuring sandbox environments with tools like Process Monitor and Regshot, and utilizing sophisticated analysis tools like ProcDot to visualize malware behavior. Additionally, the study examines the effectiveness of the Letsdefend.io platform in detecting phishing URLs and malicious domains reported by AnyRun and URLHaus databases. The findings reveal promising results in the detection and identification of phishing threats, shedding light on the potential of dynamic analysis methods in bolstering cybersecurity defenses against evolving phishing techniques. This research contributes to the ongoing efforts to enhance cybersecurity measures and protect organizational assets from the pervasive threat of phishing attacks.

Effective and Efficient Android Malware Detection and Category Classification Using the Enhanced KronoDroid Dataset

Android is the most widely used mobile operating system and responsible for handling a wide variety of data from simple messages to sensitive banking details. The explosive increase in malware targeting this platform has made it imperative to adopt machine learning approaches for effective malware detection and classification. Since its release in 2008, the Android platform has changed substantially and there has also been a significant increase in the number, complexity, and evolution of malware that target this platform. This rapid evolution quickly renders existing malware datasets out of date and has a degrading impact on machine learning-based detection models. Many studies have been carried out to explore the effectiveness of various machine learning models for Android malware detection. Majority of these studies use datasets that have compiled using static or dynamic analysis of malware but the use of hybrid analysis approaches has not been addressed completely. Likewise, the impact of malware evolution has not been fully investigated. Although some of the models have achieved exceptional results, their performance deteriorated for evolving malware and they were also not effective against antidynamic malware. In this paper, we address both these limitations by creating an enhanced subset of the KronoDroid dataset and using it to develop a supervised machine learning model capable of detecting evolving and antidynamic malware. The original KronoDroid dataset contains malware samples from 2008 to 2020, making it effective for the detection of evolving malware and handling concept drift. Also, the dynamic features are collected by executing the malware on a real device, making it effective for handling antidynamic malware. We create an enhanced subset of this dataset by adding malware category labels with the help of multiple online repositories. Then, we train multiple supervised machine learning models and use the ExtraTree classifier to select the top 50 features. Our results show that the random forest (RF) model has the highest accuracy of 98.03% for malware detection and 87.56% for malware category classification (for 15 malware categories).

Dynamic Malware Classification and API Categorisation of Windows Portable Executable Files Using Machine Learning

The rise of malware attacks presents a significant cyber-security challenge, with advanced techniques and offline command-and-control (C2) servers causing disruptions and financial losses. This paper proposes a methodology for dynamic malware analysis and classification using a malware Portable Executable (PE) file from the MalwareBazaar repository. It suggests effective strategies to mitigate the impact of evolving malware threats. For this purpose, a five-level approach for data management and experiments was utilised: (1) generation of a customised dataset by analysing a total of 582 malware and 438 goodware samples from Windows PE files; (2) feature extraction and feature scoring based on Chi2 and Gini importance; (3) empirical evaluation of six state-of-the-art baseline machine learning (ML) models, including Logistic Regression (LR), Support Vector Machine (SVM), Naive Bayes (NB), Random Forest (RF), XGBoost (XGB), and K-Nearest Neighbour (KNN), with the curated dataset; (4) malware family classification using VirusTotal APIs; and, finally, (5) categorisation of 23 distinct APIs from 266 malware APIs. According to the results, Gini’s method takes a holistic view of feature scoring, considering a wider range of API activities. The RF achieved the highest precision of 0.99, accuracy of 0.96, area under the curve (AUC) of 0.98, and F1-score of 0.96, with a 0.93 true-positive rate (TPR) and 0.0098 false-positive rate (FPR), among all applied ML models. The results show that Trojans (27%) and ransomware (22%) are the most risky among 11 malware families. Windows-based APIs (22%), the file system (12%), and registry manipulation (8.2%) showcased their importance in detecting malicious activity in API categorisation. This paper considers a dual approach for feature reduction and scoring, resulting in an improved F1-score (2%), and the inclusion of AUC and specificity metrics distinguishes it from existing research (Section Comparative Analysis with Existing Approaches). The newly generated dataset is publicly available in the GitHub repository (Data Availability Statement) to facilitate aspirant researchers’ dynamic malware analysis.

Dynamic Malware Analysis with Reinforcement Learning

Dynamic Malware Analysis with Reinforcement Learning

Exploiting And Estimating Malware Using Feature Impact Derived From API Call Sequence Learning

Malware is a serious threat being posed and it has been a continuous process of protecting the systems from existing and new malware variants by defining new approaches for malware detection .In this process malware samples are first analyzed to understand the behavior of the vulnerable samples and accordingly statistical methods are defined for malware detection. Many approaches are defined for understanding the behavior of malware executables which are broadly classified in to static and dynamic assessments. The static analysis can only be used for identifying the existing types of malware but code obfuscation has made it complex to identify the variants of existing malware. To counter the code obfuscation the dynamic analysis of malware is prioritized over static analysis where the malwares are analyzed by running them in an emulated environment to understand the intent of the samples. As there is an acute need of developing a more precise and accurate approach for malware detection, this paper contributes in the above said direction where we proposed a novel measure to estimate malware by exploiting the malicious intent of executables. It is a machine learning approach where the knowledge is acquired from the existing malicious executable and the same knowledge is used to estimate the new variants of the existing malware. The proposed statistical approach can be used to improve the scalability, accuracy and robustness. It also defends against zero day exploits.

Robust Analysis of XXE Attack Produced by Malware

Malware Analysis is one of the major growing sections in the cyber security area. Various trends and types have been introduced in the industry for example static malware analysis, Dynamic malware analysis, hybrid malware analysis and machine learning-based malware analysis techniques. There is various malware introduced for example virus, Worms, ransomware, spyware, botnets, etc. Security threats have increased drastically over the period. From viruses, spyware, worms, trojans, and ransomware to many zero-day Malware is reported and exploited in different platforms. Platforms like Windows, Android, and Cloud (Iaas or Paas). The Phenomenon is like attackers always making targets to humans via social engineering methodology or Phishing. When we talk about humans, the first thing that comes to mind of an attacker is the platform from which they will be able to concentrate on the target. The basic approach used mainly in detecting Malware in any platform is signature-based detection, which is quite beneficial. Still, as Malware is designed to be more obfuscated, detecting those malicious activities using a signature-based approach takes a lot of work. After the signature-based method, the behavior-based process is used to detect Malware. As some drawbacks appeared in both approaches, then, researchers found methodologies that can use Machine Learning Algorithms, for example, KNN, Random Forest, Nearest Neighbor, etc.

ANALISIS DAN DETEKSI MALWARE PADA PROTOKOL JARINGAN MENGGUNAKAN METODE MALWARE ANALISIS DINAMIS DAN MALWARE ANALISIS STATIS

Network security is a crucial issue in the rapidly developing era of information technology. One of the main threats is malware, which is malicious software that harms systems and data. To solve this problem, analysis and detection of malware on network protocols need to be improved using effective methods. This research explores the application of two main methods, namely static and dynamic malware analysis. First, static malware analysis involves examining malware files without running them. This method includes analysis of signatures, heuristics, and malicious code to identify typical malware patterns in files on the network.Second, dynamic malware analysis executes malware in an isolated environment (sandbox) to monitor its behavior and impact on the system. This process allows detection of malicious changes and attempts by malware to propagate itself. By combining these two methods, a holistic and efficient approach in malware detection on network protocols can be achieved. It is hoped that the results of this research can improve network security, protect infrastructure from ever-evolving malware threats. The use of static and dynamic analysis methods will help deal with increasingly complex security challenges, enabling networks to operate more securely and reliably.

CTIMD: Cyber threat intelligence enhanced malware detection using API call sequences with parameters

Dynamic malware analysis that monitors the sequences of API calls of the program in a sandbox has been proven to be effective against code obfuscation and unknown malware. However, most existing works ignore the run-time parameters by only considering the API names, or lack an effective way to capture the correlations between parameter values and malicious activities. In this paper, we propose CTIMD, a deep learning based dynamic malware detection method, which integrates the threat knowledge from CTIs (Cyber Threat Intelligences) into the learning on API call sequences with run-time parameters. It first extracts IOCs (Indicators of Compromise) from CTIs and uses IOCs to assist the identification of the security-sensitive levels of API calls. Then, it embeds API calls and the associated security-sensitive levels into a unified feature space. Finally, it feeds the feature vector sequences into deep neural networks to train the malware detection model. We conducted experiments on two datasets. The experiment results show that CTIMD significantly outperforms existing methods depending on raw API call sequences (F1-score is improved by 4.0 %∼41.3 %), and also has advantage over existing state-of-the-art methods that consider both API calls and run-time parameters (F1-score is improved by 1.2 %∼6.5 %).

DroidDetectMW: A Hybrid Intelligent Model for Android Malware Detection

Malicious apps specifically aimed at the Android platform have increased in tandem with the proliferation of mobile devices. Malware is now so carefully written that it is difficult to detect. Due to the exponential growth in malware, manual methods of malware are increasingly ineffective. Although prior writers have proposed numerous high-quality approaches, static and dynamic assessments inherently necessitate intricate procedures. The obfuscation methods used by modern malware are incredibly complex and clever. As a result, it cannot be detected using only static malware analysis. As a result, this work presents a hybrid analysis approach, partially tailored for multiple-feature data, for identifying Android malware and classifying malware families to improve Android malware detection and classification. This paper offers a hybrid method that combines static and dynamic malware analysis to give a full view of the threat. Three distinct phases make up the framework proposed in this research. Normalization and feature extraction procedures are used in the first phase of pre-processing. Both static and dynamic features undergo feature selection in the second phase. Two feature selection strategies are proposed to choose the best subset of features to use for both static and dynamic features. The third phase involves applying a newly proposed detection model to classify android apps; this model uses a neural network optimized with an improved version of HHO. Application of binary and multi-class classification is used, with binary classification for benign and malware apps and multi-class classification for detecting malware categories and families. By utilizing the features gleaned from static and dynamic malware analysis, several machine-learning methods are used for malware classification. According to the results of the experiments, the hybrid approach improves the accuracy of detection and classification of Android malware compared to the scenario when considering static and dynamic information separately.

Malware API Calls Detection Using Hybrid Logistic Regression and RNN Model

Behavioral malware analysis is a powerful technique used against zero-day and obfuscated malware. Additionally referred to as dynamic malware analysis, this approach employs various methods to achieve enhanced detection. One such method involves using machine learning and deep learning algorithms to learn from the behavior of malware. However, the task of weight initialization in neural networks remains an active area of research. In this paper, we present a novel hybrid model that utilizes both machine learning and deep learning algorithms to detect malware across various categories. The proposed model achieves this by recognizing the malicious functions performed by the malware, which can be inferred from its API call sequences. Failure to detect these malware instances can result in severe cyberattacks, which pose a significant threat to the confidentiality, privacy, and availability of systems. We rely on a secondary dataset containing API call sequences, and we apply logistic regression to obtain the initial weight that serves as input to the neural network. By utilizing this hybrid approach, our research aims to address the challenges associated with traditional weight initialization techniques and to improve the accuracy and efficiency of malware detection based on API calls. The integration of both machine learning and deep learning algorithms allows the proposed model to capitalize on the strengths of each approach, potentially leading to a more robust and versatile solution to malware detection. Moreover, our research contributes to the ongoing efforts in the field of neural networks, by offering a novel perspective on weight initialization techniques and their impact on the performance of neural networks in the context of behavioral malware analysis. Experimental results using a balanced dataset showed 83% accuracy and a 0.44 loss, which outperformed the baseline model in terms of the minimum loss. The imbalanced dataset’s accuracy was 98%, and the loss was 0.10, which exceeded the state-of-the-art model’s accuracy. This demonstrates how well the suggested model can handle malware classification.

Separating Malicious from Benign Software Using Deep Learning Algorithm

The increased usage of the Internet raises cyber security attacks in digital environments. One of the largest threats that initiate cyber attacks is malicious software known as malware. Automatic creation of malware as well as obfuscation and packing techniques make the malicious detection processes a very challenging task. The obfuscation techniques allow malware variants to bypass most of the leading literature malware detection methods. In this paper, a more effective malware detection system is proposed. The goal of the study is to detect traditional as well as new and complex malware variants. The proposed approach consists of three modules. Initially, the malware samples are collected and analyzed by using dynamic malware analysis tools, and execution traces are collected. Then, the collected system calls are used to create malware behaviors as well as features. Finally, a proposed deep learning methodology is used to effectively separate malware from benign samples. The deep learning methodology consists of one input layer, three hidden layers, and an output layer. In hidden layers, 500, 64, and 32 fully connected neurons are used in the first, second, and third hidden layers, respectively. To keep the model simple as well as obtain optimal solutions, we have selected three hidden layers in which neurons are decreasing in the following subsequent layers. To increase the model performance and use more important features, various activation functions are used. The test results show that the proposed system can effectively detect the malware with more than 99% DR, f-measure, and 99.80 accuracy, which is substantially high when compared with other methods. The proposed system can recognize new malware variants that could not be detected with signature, heuristic, and some behavior-based detection techniques. Further, the proposed system has performed better than the well-known methods that are mentioned in the literature based on the DR, precision, recall, f-measure, and accuracy metrics.

An algorithm for scheduling of threads for system and application code split approach in dynamic malware analysis

An algorithm for scheduling of threads for system and application code split approach in dynamic malware analysis

A Supervised Machine Learning Ransomware Host-Based Detection Framework

Today, the term ransomware is frequently used in cybercrime headlines, its consequences have been on the rise leaving a trail of terrible losses in its wake. Both people and businesses have been victimized by ransomware, costing the victims millions of dollars in ransom payments. In addition, victims who were unable to pay the ransom or decrypt the data experienced data losses. This study uses dynamic malware analysis artifacts and supervised machine learning to detect ransomware at the host level. It takes on a thorough examination of the operational specifics of ransomware and suggests a supervised machine-learning approach to detection using various ransomware features derived from dynamic malware analysis. According to the findings, a Logistic Regression algorithm model with a 97.7% accuracy score offers a 99% success rate in ransomware detection. This demonstrates how well machine learning and dynamic malware analysis work together to detect ransomware activity at the host level. Systems security administrators can mitigate security risks by using this method.

Security of Blockchain and AI-Empowered Smart Healthcare: Application-Based Analysis

A smart device carries a great amount of sensitive patient data as it offers innovative and enhanced functionalities in the smart healthcare system. Moreover, the components of healthcare systems are interconnected via the Internet, bringing significant changes to the delivery of healthcare services to individuals. However, easy access to healthcare services and applications has given rise to severe risks and vulnerabilities that hamper the performance of a smart healthcare system. Moreover, a large number of heterogeneous devices accumulate data that vary in terms of size and formats, making it challenging to manage the data in the healthcare repository and secure it from attackers who seek to profit from the data. Thus, smart healthcare systems are susceptible to numerous security threats and risks, such as hardware and software-based attacks, system-level attacks, and network attacks that have the potential to place patients’ lives at risk. An analysis of the literature revealed a research gap in that most security surveys on the healthcare ecosystem examined only the security challenges and did not explore the possibility of integrating modern technologies to alleviate security issues in the smart healthcare system. Therefore, in this article, we conduct a comprehensive review of the various most recent security challenges and their countermeasures in the smart healthcare environment. In addition, an artificial intelligence (AI) and blockchain-based secure architecture is proposed as a case study to analyse malware and network attacks on wearable devices. The proposed architecture is evaluated using various performance metrics such as blockchain scalability, accuracy, and dynamic malware analysis. Lastly, we highlight different open issues and research challenges facing smart healthcare systems.

Analisis Pola dan Dampak Serangan Cryptojacking dengan Menggunakan Metode Analisis Dinamis dan Analisis Statis

In the current era of globalization, people's daily activities are highly dependent on technology. The development of this technology is certainly utilized by many different parties. In addition to taking advantage of the positive side, there are also parts that take advantage of the negative side. In this case it is like developing criminal software or what is commonly called cybercrime. One form of this crime is cryptojacking. Cryptojacking is the dark side of cryptocurrency mining and poses a threat to website visitors or end-users. This research was carried out with a 6-step method which resulted in the result that based on static and dynamic malware analysis, the installation of Crackonosh itself runs by replacing important files on the Windows system and abusing Windows Safe Mode to damage the order and defense of the Windows system

DMalNet: Dynamic malware analysis based on API feature engineering and graph learning

Application Programming Interfaces (APIs) are widely considered a useful data source for dynamic malware analysis to understand the behavioral characteristics of malware. However, the accuracy of API-based malware analysis is limited for two reasons. (1) Existing solutions often only consider the API names while ignoring the API arguments, or cannot fully exploit the semantic information from different types of arguments. (2) The relationship between API calls is important to describe the software behavior but is difficult to capture. To overcome the above limitations, we propose DMalNet, a novel malware analysis framework for accurate malware detection and classification. Specifically, we first present a hybrid feature encoder to extract semantic features from API names and arguments. Then, we derive an API call graph from the API call sequence to convert the relationship between API calls into the structural information of the graph. Finally, we design a graph neural network to implement the malware detection and type classification. To evaluate our approach, we use datasets of over 20k benign and 18k malicious samples belonging to 8 malware types. DMalNet achieves 98.43% and 91.42% accuracy on malware detection and malware type classification, respectively. We also conduct ablation studies to assess the impact of API feature engineering and the graph learning model. Further experiments show that DMalNet can effectively detect malware.

A time-interval-based active learning framework for enhanced PE malware acquisition and detection

Malware increasingly threatens users around the world on a variety of cybernetic platforms, resulting in damages of billions of dollars each year. In recent years, in order to improve the detection capabilities of widely used antivirus (AV) tools, machine learning (ML) algorithms and dynamic malware analysis have been leveraged for the extraction and learning of rich multivariate time-series data (MTSD) associated with behavioral information. Such MTSD can be exploited using a time-interval temporal pattern (TP) mining approach, however this approach has not been widely explored for the task of malware detection. The use of TPs enables the discovery of complex temporal relations between different variables, improves the ability to cope with missing values and noisy data, and provides explainability. In light of the continuous creation of new unknown malware on a daily basis, detection mechanisms require frequent updating to keep pace with the changing reality. Active learning (AL) can address the updatability gap by efficiently selecting and acquiring a small yet informative set of new samples while reducing the labeling efforts of experts; AL also provides maximal improvement of machine-learning-based detection models, which can further contribute to the updatability of antimalware tools. However, the use of AL methods for the acquisition of time-interval TP-based samples has yet to be explored. In this paper, we present novel AL methods and a detection framework for improved malware detection based on dynamic analysis, time-interval TPs, and ML algorithms. The proposed framework is capable of both prioritizing the acquisition of malicious samples and improving the malware detection capabilities of ML classifiers and antimalware tools. Our proposed framework was evaluated in an extensive set of experiments on a comprehensive data collection of 9,328 portable executables (5,000 benign and 4,328 malicious) that were executed in the Windows 10 environment. The results demonstrated our AL methods’ ability to prioritize the acquisition of malware and managed to acquire up to 93.5% of the malicious files each day, allowing frequent updating of antimalware tools. In addition, our framework was shown to be effective in improving the detection capabilities of several ML classifiers over time, with the best results (AUC of 95.15%) achieved by the SVM classifier. Our framework also showed that TPs can be used to identify emerging trends in malicious behavior.

ConcSpectre: Be Aware of Forthcoming Malware Hidden in Concurrent Programs

Concurrent programs with multiple threads executing in parallel are widely used to unleash the power of multicore computing systems. Owing to their complexity, a lot of research focuses on testing and debugging concurrent programs. Besides correctness, we find that security can also be compromised by concurrency. In this article, we present concurrent program spectre (ConcSpectre), a new security threat that hides malware in nondeterministic thread interleavings. To demonstrate such threat, we have developed a stealth malware technique called concurrent logic bomb by partitioning a piece of malicious code and injecting its components separately into a concurrent program. The malicious behavior can be triggered by certain thread interleavings that rarely happen (e.g., <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$&lt; $</tex-math></inline-formula> 1%) under a normal execution environment. However, with a new technique called controllable probabilistic activation, we can activate such ConcSpectre malware with a very high probability (e.g., <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$&gt;$</tex-math></inline-formula> 90%) by remotely disturbing thread scheduling. In the evaluation, more than 1000 ConcSpectre samples are generated, which bypassed most of the antivirus engines in VirusTotal and four well-known online dynamic malware analysis systems. We also demonstrate how to remotely trigger a ConcSpectre sample on a web server and control its activation probability. Our work shows an urgent need for new malware analysis methods for concurrent programs.