Efficient Malware Detection Research Articles

Efficient Malware Detection in Android Devices to Improve Cyber Security

The project introduces a novel framework for detecting Android malware based on permissions, utilizing multiple linear regression methods. Permissions play a crucial role in the security of the Android operating system, serving as fundamental indicators of an application's behavior. Through static analysis, the framework extracts application permissions and employs machine learning techniques to conduct security analyses. Specifically, the framework employs multiple linear regression techniques to develop two classifiers for permission-based Android malware detection. These classifiers leverage the relationships between various permission attributes to accurately identify potentially malicious applications. Notably, the framework achieves notable performance levels using classification algorithms without the need for overly complex models. In the project, the existing system utilizes the Random Forest (RF) algorithm, while the proposed system adopts the Support Vector Machine (SVM) algorithm. Both algorithms are evaluated in terms of accuracy, with the results demonstrating that the proposed SVM approach outperforms the existing RF method. This highlights the effectiveness of SVM in accurately detecting Android malware based on permission analysis.

RETRACTED: TriCh-LKRepNet: A large kernel convolutional malicious code classification network for structure reparameterisation and triple-channel mapping

In response to escalating cybersecurity threats, this study aims to develop a lightweight deep learning model for efficient and accurate detection and classification of malware. To achieve this goal, the study introduces RGB-MalNet, a novel network architecture that balances performance and resource utilization. The method innovatively transforms malware representations into image channels through RGB three-channel mapping, which improves information richness and discriminative power. RGB-MalNet creates a streamlined framework that optimizes network connections, reduces memory access overhead, and boosts overall efficiency. The model achieves accuracy rates of 99.47% and 97.55% on the Kaggle and DataCon datasets, respectively. Compared to existing methodologies, this approach stands out in terms of performance, resource consumption, and versatility. It offers a viable and efficient solution for malicious code detection and classification.

Efficient malware detection through inter-component communication analysis

Efficient malware detection through inter-component communication analysis

A Hybrid Optimization Model for Efficient Detection and Classification of Malware in the Internet of Things

The proliferation of Internet of Things (IoT) devices and their integration into critical infrastructure and business operations has rendered them susceptible to malware and cyber-attacks. Such malware presents a threat to the availability and reliability of IoT devices, and a failure to address it can have far-reaching impacts. Due to the limited resources of IoT devices, traditional rule-based detection systems are often ineffective against sophisticated attackers. This paper addressed these issues by designing a new framework that uses a machine learning (ML) algorithm for the detection of malware. Additionally, it also employed sequential detection architecture and evaluated eight malware datasets. The design framework is lightweight and effective in data processing and feature selection algorithms. Moreover, this work proposed a classification model that utilizes one support vector machine (SVM) algorithm and is individually tuned with three different optimization algorithms. The employed optimization algorithms are Nuclear Reactor Optimization (NRO), Artificial Rabbits Optimization (ARO), and Particle Swarm Optimization (PSO). These algorithms are used to explore a diverse search space and ensure robustness in optimizing the SVM for malware detection. After extensive simulations, our proposed framework achieved the desired accuracy among eleven existing ML algorithms and three proposed ensemblers (i.e., NRO_SVM, ARO_SVM, and PSO_SVM). Among all algorithms, NRO_SVM outperforms the others with an accuracy rate of 97.8%, an F1 score of 97%, and a recall of 99%, and has fewer false positives and false negatives. In addition, our model successfully identified and prevented malware-induced attacks with a high probability of recognizing new evolving threats.

A hybrid approach for malware detection in SDN‐enabled IoT scenarios

AbstractMalware presents a significant threat to computer systems security, especially in ARM and MIPS architectures, driven by the rise of the internet of things (IoT). This paper introduces Heimdall, a hybrid approach that integrates YARA signatures and machine learning in programmable switches for efficient malware detection in SDN‐enabled IoT environments. The machine learning classifier achieved an accuracy of 99.33% against the IoT‐23 dataset. When evaluated in an emulated environment with real malware samples, Heimdall exhibits a 98.44% detection rate and an average processing time of 0.0217 s.

DEF: Deep Ensemble Neural Network Classifier for Android Malware Detection

Malware is one of the threats to security of computer networks and information systems. Since malware instances are available sufficiently, there is increased interest among researchers on usage of Artificial Intelligence (AI). Of late AI-enabled methods such as machine learning (ML) and deep learning paved way for solving many real-world problems. As it is a learning-based approach, accumulated training samples help in improving thequality of training and thus leveraging malware detection accuracy. Existing deep learning methods are focusing on learning-based malware detection systems. However, there is need for improving the state of the art through ensemble approach. Towards this end, in this paper we proposed a framework known as Deep Ensemble Framework (DEF) for automatic malware detection. The framework obtains features from training samples. From given malware instance a grayscale image is generated. There is another process to extract the opcode sequences. Convolutional Neural Network (CNN) and Long Short Term Memory (LSTM) techniques are used to obtain grayscale image and opcode sequence respectively. Afterwards, a stacking ensemble is employed in order to achieve efficient malware detection and classification. Malware samples collected from the Internet sources and Microsoft are used for the empirical study. An algorithm known as Ensemble Learning for Automatic Malware Detection (EL-AML) is proposed to realize our framework. Another algorithm named Pre-Process is proposed to assist the ELAML algorithm for obtaining intermediate features required by CNN and LSTM. Empirical study reveals that our framework outperforms many existing methods in terms of speed-up and accuracy.

FAGnet: Family-aware-based android malware analysis using graph neural network

Android malware family analysis is essential for building an efficient malware detection mechanism. In recent years, many graph representation learning-based malware detection and classification studies have been proposed, and many methods model malware as graph data to mine the behavioral semantics of malware. However, they do not consider the relationship at the sample (graph) level, and malware belonging to the same family has similar malicious behavior. The transformation of samples according to the Data Processing Inequality (DPI) will lead to the loss of mutual information transmission, which inspired us to consider the analysis of malware based on graph representation learning from this perspective. In this paper, we consider introducing the relationship between malware samples, inserting a family representation refinement component that is conducive to improving the family separability in the graph classification task, and propose a Family-Aware Graph neural network Android malware analysis (FAGnet). We use 4 backbones to perform extension experiments on 2 benchmark datasets and comprehensively compare some baseline methods. The experiments verify the effectiveness of FAGnet, which achieves 98.11 % accuracy on the Drebin dataset and 83.45 % and 72.76 % accuracy on the CICAndMal2017 category and family classification, respectively. In addition, FAGnet is evaluated with real-world data, and its satisfactory performance was maintained in real-world scenarios.

Hybrid machine learning model for malware analysis in android apps

Android smartphones have been widely adopted across the globe. They have the capability to access private and confidential information resulting in these devices being targeted by malware devisers. The dramatic escalation of assaults build an awareness to create a robust system that detects the occurrence of malicious actions in Android applications. The malware exposure study consists of static and dynamic analysis. This research work proposed a hybrid machine learning model based on static and dynamic analysis which offers efficient classification and detection of Android malware. The proposed novel malware classification technique can process any android application, then extracts its features, and predicts whether the applications under process is malware or benign. The proposed malware detection model can characterizes diverse malware types from Android platform with high positive rate. The proposed approach detects malicious applications in reduced execution time while also improving the security of Android as compared to existing approaches. State-of-the-art machine learning algorithms such as Support Vector Machine, k-Nearest Neighbor, Naïve Bayes, and different ensembles are employed on benign and malign applications to assess the execution of all classifiers on permissions, API calls and intents to identify malware. The proposed technique is evaluated on Drebin, MalGenome and Kaggle dataset, and outcomes indicate that this robust system improved runtime detection of malware with high speed and accuracy. Best accuracy of 100% is achieved on benchmark dataset when compared with state of the art techniques. Furthermore, the proposed approach outperforms state of the art techniques in terms of computational time, true positive rate, false positive rate, accuracy, precision, recall, and f-measure.

MobiPCR: Efficient, accurate, and strict ML-based mobile malware detection

Mobile devices have been and will be continuously prevalent as rich applications are provided for various demands. However, the mobile operating system lacks efficient malware detection tools, which puts personal data at risk. This paper presents MobiPCR, a trict, accurate, efficient mobile-oriented malware detection system. MobiPCR basically integrates a (n) (edge) cloud-based architecture, a powerful yet efficient machine learning-based detection model, and a neat detection process. We implemented the MobiPCR prototype system and conducted rigorous experiments to evaluate its performance from different perspectives. We implemented the MobiPCR prototype system on the Android platform (Installer Hooker part) consiering considering that Android is an open-source platform that (i) can be easily modified and (ii) provides rich documentation. We used LineageOS 13 (a widespread Android distribution) to provide the necessary drivers to support communication and the camera for casual usage. Experimental results prove that MobiPCR can strictly and accurately detect malwares and outperform existing similar applications without extra operations.

Improved chimp optimization algorithm (ICOA) feature selection and deep neural network framework for internet of things (IOT) based android malware detection

Internet of Things (IoT) is extensively implemented using Android applications thus detecting malicious Android apps is necessary. Malicious has been multiplying fast as a result of the growing usage of smartphones. The Android platform is often left vulnerable to new and undiscovered malware because to the increasing quantity and variety of Android malware that has considerably undermined the efficiency of the traditional defence systems. Several data-driven malware detection techniques were being out. Furthermore, these techniques face two major obstacles: How to acquire useful feature representations from raw data; How to lessen feature learning's reliance on past knowledge or individual workers. This research work proposed a system for detecting malware that begins by teaching rich characteristics an improved chimp optimization algorithm (ICOA) based feature selection and Deep Neural Network Framework (DNNF) for accurate detecting of Android malware. Deep learning methods' widespread use in the industry of feature representation learning served as an inspiration for this framework. Raw feature preprocessing, feature representation learning, and malware detection are the three key components of the proposed DNNF. The second phase is to learn high-level discriminative features to fuel malware identification using the ICOA. Finally, a DNNF based on Long Short-Term Memory (LSTM) is created for efficient malware detection in Android applications. Based on the findings of the simulations, it seems that the DNNF model that was suggested offers high recognition accuracy in comparison to other approaches that are considered to be state of the art.

A system call-based android malware detection approach with homogeneous & heterogeneous ensemble machine learning

The enormous popularity of Android in the smartphone market has gained the attention of malicious actors as well. Also, considering its open system architecture, malicious attacks don’t seem to wane anytime soon. Cybercriminals use deceptive attack strategies like obfuscation or dynamic code loading to evade the system. A conventional static analysis approach fails to identify such attacks. Mitigating a wide range of evasive attacks requires excogitating savvy dynamic analysis framework. This paper proposes a precise dynamic analysis approach to identify a slew of malicious attacks. The proposed method focus on behavioral analysis of malware that requires reconstructing the behavior of Android malware. The dynamic behavior features used include system calls, binders, and complex Android objects (composite behavior). For efficient malware detection and classification, a feature selection method is used to remove extraneous features. For classification, we use homogeneous and heterogeneous ensemble machine learning algorithms. The stacking approach has the best classification results with an accuracy rate of 98.08%. The rigorous experimental results show the effectiveness and superiority of the model.

BejaGNN: behavior-based Java malware detection via graph neural network.

As a popular platform-independent language, Java is widely used in enterprise applications. In the past few years, language vulnerabilities exploited by Java malware have become increasingly prevalent, which cause threats for multi-platform. Security researchers continuously propose various approaches for fighting against Java malware programs. The low code path coverage and poor execution efficiency of dynamic analysis limit the large-scale application of dynamic Java malware detection methods. Therefore, researchers turn to extracting abundant static features to implement efficient malware detection. In this paper, we explore the direction of capturing malware semantic information by using graph learning algorithms and present BejaGNN (Behavior-based Java malware detection via Graph Neural Network), a novel behavior-based Java malware detection method using static analysis, word embedding technique, and graph neural network. Specifically, BejaGNN leverages static analysis techniques to extract ICFGs (Inter-procedural Control Flow Graph) from Java program files and then prunes these ICFGs to remove noisy instructions. Then, word embedding techniques are adopted to learn semantic representations for Java bytecode instructions. Finally, BejaGNN builds a graph neural network classifier to determine the maliciousness of Java programs. Experimental results on a public Java bytecode benchmark demonstrate that BejaGNN achieves high F1 98.8% and is superior to existing Java malware detection approaches, which verifies the promise of graph neural network in Java malware detection.

A novel deep learning-based approach for malware detection

Malware detection approaches can be classified into two classes, including static analysis and dynamic analysis. Conventional approaches of the two classes have their respective advantages and disadvantages. For example, static analysis is faster but cannot detect the malware variants generated through code obfuscation, whereas dynamic analysis can effectively detect variants generated through code obfuscation but is slower and requires intensive resources. This paper proposes a novel deep learning-based approach for malware detection. It delivers better performance than conventional approaches by combining static and dynamic analysis advantages. First, it visualises a portable executable (PE) file as a coloured image. Second, it extracts deep features from the colour image using fine-tuned deep learning model. Third, it detects malware based on the deep features using support vector machines (SVM). The proposed method combines deep learning with machine learning and eliminates the need for intensive feature engineering tasks and domain knowledge. The proposed approach is scalable, cost-effective, and efficient. The detection effectiveness of the proposed method is validated through 12 machine learning models and 15 deep learning models. The generalisability of the proposed framework is validated on various benchmark datasets. The proposed approach outperformed with an accuracy of 99.06% on the Malimg dataset. The Wilcoxon signed-rank test is used to show the statistical significance of the proposed framework. The detailed experimental results demonstrate the superiority of the proposed method over the other state-of-the-art approaches, with an average increase in accuracy of 16.56%. Finally, to tackle the problems of imbalanced data and the shortage of publicly available datasets for malware detection, various data augmentation techniques are proposed, which lead to improved performance. It is evident from the results that the proposed framework can be useful to the defence industry, which will be helpful in devising more efficient malware detection solutions.

Binary and Multi-Class Malware Threads Classification

The security of a computer system can be harmed by specific applications, such as malware. Malware comprises unwanted, dangerous enemies that aim to compromise the security and generate significant loss. Consequently, Malware Detection (MD) and Malware Classification (MC) has emerged as a key issue for the cybersecurity society. MD only involves locating malware without determining what kind of malware it is, but MC comprises assigning a class of malware to a particular sample. Recently, a few techniques for analyzing malware quickly have been put out. However, there remain numerous difficulties, such as the low classification accuracy of samples from related malware families, the computational complexity, and consumption of resources. These difficulties make detecting and classifying malware very challenging. Therefore, in this paper, we proposed an efficient malware detection and classification technique that combines Segmentation-based Fractal Texture Analysis (SFTA) and Gaussian Discriminant Analysis (GDA). The outcomes of the experiment demonstrate that the SFTA-GDA produces a high classification rate. There are three main steps involved in our malware analysis, namely: (i) malware conversion; (ii) feature extraction; and (iii) classification. We initially convert the RGB malware images into grayscale malware images for effective malware analysis. The SFTA and Gabor features are then extracted from gray-scale images in the feature extraction step. Finally, the classification is carried out by GDA and Naive Bayes (NB). The proposed method is evaluated on a common MaleVis dataset. The proposed SFTA-GDA is the effective choice since it produces the highest accuracy rate across all families of the MaleVis Database. Experimental findings indicate that the accuracy rate was 98%, which is higher than the overall accuracy from the existing state-of-the-art methods.

Android malware detection method based on highly distinguishable static features and DenseNet.

The rapid growth of malware has become a serious problem that threatens the security of the mobile ecosystem and needs to be studied and resolved. Android is the main target of attackers due to its open source and popularity. To solve this serious problem, an accurate and efficient malware detection method is needed. Most existing methods use a single type of feature, which can be easily bypassed, resulting in low detection accuracy. In addition, although multiple types of features are used in some methods to solve the drawbacks of detection methods using a single type of feature, there are still some problems. Firstly, due to multiple types of features, the number of features in the initial feature set is extremely large, and some methods directly use them for training, resulting in excessive overhead. Furthermore, some methods utilize feature selection to reduce the dimensionality of features, but they do not select highly distinguishable features, resulting in poor detection performance. In this article, an effective and accurate method for identifying Android malware, which is based on an analysis of the use of seven types of static features in Android is proposed to cope with the rapid increase in the amount of Android malware and overcome the drawbacks of detection methods using a single type of feature. Instead of utilizing all extracted features, we design three levels of feature selection methods to obtain highly distinguishable features that can be effective in identifying malware. Then a fully densely connected convolutional network based on DenseNet is adopted to leverage features more efficiently and effectively for malware detection. Compared with the number of features in the original feature set, the number of features in the feature set obtained by the three levels of feature selection methods is reduced by about 97%, but the accuracy is only reduced by 0.45%, and the accuracy is more than 99% in a variety of machine learning methods. Moreover, we compare our detection method with different machine learning models, and the experimental results show that our method outperforms general machine learning models. We also compare the performance of our detection method with two state-of-the-art neural networks. The experimental results show that our detection model can greatly reduce the training cost and still achieve good detection performance, reaching an accuracy of 99.72%. In addition, we compare our detection method with other similar detection methods that also use multiple types of features. The results show that our detection method is superior to the comparison methods.

Embedding and Siamese deep neural network-based malware detection in Internet of Things

Purpose A proper understanding of malware characteristics is necessary to protect massive data generated because of the advances in Internet of Things (IoT), big data and the cloud. Because of the encryption techniques used by the attackers, network security experts struggle to develop an efficient malware detection technique. Though few machine learning-based techniques are used by researchers for malware detection, large amounts of data must be processed and detection accuracy needs to be improved for efficient malware detection. Deep learning-based methods have gained significant momentum in recent years for the accurate detection of malware. The purpose of this paper is to create an efficient malware detection system for the IoT using Siamese deep neural networks. Design/methodology/approach In this work, a novel Siamese deep neural network system with an embedding vector is proposed. Siamese systems have generated significant interest because of their capacity to pick up a significant portion of the input. The proposed method is efficient in malware detection in the IoT because it learns from a few records to improve forecasts. The goal is to determine the evolution of malware similarity in emerging domains of technology. Findings The cloud platform is used to perform experiments on the Malimg data set. ResNet50 was pretrained as a component of the subsystem that established embedding. Each system reviews a set of input documents to determine whether they belong to the same family. The results of the experiments show that the proposed method outperforms existing techniques in terms of accuracy and efficiency. Originality/value The proposed work generates an embedding for each input. Each system examined a collection of data files to determine whether they belonged to the same family. Cosine proximity is also used to estimate the vector similarity in a high-dimensional area.

Minimized feature overhead malware detection machine learning model employing MRMR‐based ranking

SummaryTo deal with the huge amount of data, minimizing the overhead will play a key role in speedy and efficient malware detection. We propose a machine learning (ML) malware detection model with preprocessing to limit the feature overhead. The portable‐executable (PE) header information that retains meaningful and distinctive information has been considered to classify benign and malware files. The dataset is preprocessed by applying transformation, outlier detection and filling, and smoothing techniques. A maximum relevance minimum redundancy‐based feature selection method is deployed to assign the rank and score to each feature retaining the maximum relevant and minimal redundant information. Based on the obtained rank, many subsets of features have been created and investigated against support vector machine (SVM) and k‐nearest neighbors (k‐NN) with parametric tuning. The proposed ML model integrated with data preprocessing, feature selection, and SVM‐polynomial classifier has superior performance. This model is eliminating 63.8% feature overhead with accuracy above 99.1% for the benchmark datasets. To examine the robustness of the proposed model, new balanced and imbalanced datasets are created using new malware. The test results are encouraging with accuracy and specificity above 96.68%, 97.65%, and 91.57%, respectively. Interestingly, the proposed model is not trained using the newly created dataset.

Techniques for Detecting Malware Traffic: A Comprehensive Approach to Feature Selection and Classification

Abstract: Since the advent of encryption, there has been a steady increase in malware being transmitted over encrypted networks. Traditional approaches to detect malware like packet content analysis are inefficient in dealing with encrypted data. In the absence of actual packet contents, we can make use of other features like packet size, arrival time, source and destination addresses and other such metadata to detect malware. Such information can be used to train machine learning classifiers in order to classify malicious and benign packets. In this paper, we offer an efficient malware detection approach using classification algorithms in machine learning such as support vector machine, random forest and extreme gradient boosting. We employ an extensive feature selection process to reduce the dimensionality of the chosen dataset. The dataset is then split into training and testing sets. Machine learning algorithms are trained using the training set. These models are then evaluated against the testing set in order to assess their respective performances. We further attempt to tune the hyper parameters of the algorithms, in order to achieve better results. Random forest and extreme gradient boosting algorithms performed exceptionally well in our experiments, resulting in area under the curve values of 0.9928 and 0.9998 respectively. Our work demonstrates that malware traffic can be effectively classified using conventional machine learning algorithms and also shows the importance of dimensionality reduction in such classification problems. Keywords: Malware Detection, Extreme Gradient Boosting, Random Forest, Feature Selection.

An efficient malware detection approach with feature weighting based on Harris Hawks optimization

An efficient malware detection approach with feature weighting based on Harris Hawks optimization

Visualized Malware Multi-Classification Framework Using Fine-Tuned CNN-Based Transfer Learning Models

There is a massive growth in malicious software (Malware) development, which causes substantial security threats to individuals and organizations. Cybersecurity researchers makes continuous efforts to defend against these malware risks. This research aims to exploit the significant advantages of Transfer Learning (TL) and Fine-Tuning (FT) methods to introduce efficient malware detection in the context of imbalanced families without the need to apply complex features extraction or data augmentation processes. Therefore, this paper proposes a visualized malware multi-classification framework to avoid false positives and imbalanced datasets’ challenges through using the fine-tuned convolutional neural network (CNN)-based TL models. The proposed framework comprises eight different FT CNN models including VGG16, AlexNet, DarkNet-53, DenseNet-201, Inception-V3, Places365-GoogleNet, ResNet-50, and MobileNet-V2. First, the binary files of different malware families were transformed into 2D images and then forwarded to the FT CNN models to detect and classify the malware families. The detection and classification performance was examined on a benchmark Malimg imbalanced dataset using different, comprehensive evaluation metrics. The evaluation results prove the FT CNN models’ significance in detecting malware types with high accuracy that reached 99.97% which also outperforms the performance of related machine learning (ML) and deep learning (DL)-based malware multi-classification approaches tested on the same malware dataset.