Fileless Malware Research Articles

Deep feature transfer learning for trusted and automated malware signature generation in private cloud environments

This paper presents TrustSign, a novel, trusted automatic malware signature generation method based on high-level deep features transferred from a VGG-19 neural network model pretrained on the ImageNet dataset. While traditional automatic malware signature generation techniques rely on static or dynamic analysis of the malware’s executable, our method overcomes the limitations associated with these techniques by producing signatures based on the presence of the malicious process in the volatile memory. By leveraging the cloud’s virtualization technology, TrustSign analyzes the malicious process in a trusted manner, since the malware is unaware and cannot interfere with the inspection procedure. Additionally, by removing the dependency on the malware’s executable, our method is fully capable of signing fileless malware as well. TrustSign’s signature generation process does not require feature engineering or any additional model training, and it is done in a completely unsupervised manner, eliminating the need for a human expert. Because of this, our method has the advantage of dramatically reducing signature generation and distribution time. In fact, in this paper we rethink the typical use of deep convolutional neural networks and use the VGG-19 model as a topological feature extractor for a vastly different task from the one it was trained for. The results of our experimental evaluation demonstrate TrustSign’s ability to generate signatures impervious to the process state over time. By using the signatures generated by TrustSign as input for various supervised classifiers, we achieved up to 99.5% classification accuracy.

An emerging threat Fileless malware: a survey and research challenges

With the evolution of cybersecurity countermeasures, the threat landscape has also evolved, especially in malware from traditional file-based malware to sophisticated and multifarious fileless malware. Fileless malware does not use traditional executables to carry-out its activities. So, it does not use the file system, thereby evading signature-based detection system. The fileless malware attack is catastrophic for any enterprise because of its persistence, and power to evade any anti-virus solutions. The malware leverages the power of operating systems, trusted tools to accomplish its malicious intent. To analyze such malware, security professionals use forensic tools to trace the attacker, whereas the attacker might use anti-forensics tools to erase their traces. This survey makes a comprehensive analysis of fileless malware and their detection techniques that are available in the literature. We present a process model to handle fileless malware attacks in the incident response process. In the end, the specific research gaps present in the proposed process model are identified, and associated challenges are highlighted.

DGA Domain Name Classification Method Based on Long Short-Term Memory with Attention Mechanism

Currently, many cyberattacks use the Domain Generation Algorithm (DGA) to generate random domain names, so as to maintain communication with the Communication and Control (C&C) server. Discovering DGA domain names in advance could help to detect attacks and response in time. However, in recent years, the General Data Protection Regulation (GDPR) has been promulgated and implemented, and the method of DGA classification based on the context information, such as the WHOIS (the information about the registered users or assignees of the domain name), is no longer applicable. At the same time, acquiring the DGA algorithm by reversing malware samples encounters the problem of no malware samples for various reasons, such as fileless malware. We propose a DGA domain name classification method based on Long Short-Term Memory (LSTM) with attention mechanism. This method is oriented to the character sequence of the domain name, and it uses the LSTM combined with attention mechanism to construct the DGA domain name classifier to achieve the rapid classification of domain names. The experimental results show that the method has a good classification result.

Best practices for fighting the fileless threat

In their continuous quest to find new tools, techniques and tactics to outsmart the white hats, hackers have hit upon a pretty effective strategy. Fileless malware attacks are on the rise, but we still have to worry about file-based approaches, making for a complex situation for defenders. Fileless malware attacks are on the rise, but we can't afford to overlook existing threats, creating a complex situation for defenders. The answer lies with a back-to-basics approach based around some key cyber hygiene processes such as patch management and app control, layered up to maximise prevention and minimise risk. With a good foundation in place, expanding to include detection and response can now be done successfully, argues Andy Baldin of Ivanti.

Analysis of Advanced Volatile Threats Using Memory Forensics

Malwares has always been one of the greatest threat actors for the organizations with their digital information infrastructure. Malware is any malicious program, file or executable whose prime purpose is to gain an unauthorized access or cause harm to the computer or the network system. It has always been a subject of concern for computer experts or even the users as the harm due to different types of malwares is increasing exponentially. Malware can be in any form i.e.; virus, computer worm, Trojan, phishing frauds etc. These threats actors are constantly evolving with a new and sophisticated ways to avoid detection and successfully perform the attacks. The rising power and ambitions were specially seen during year 2017 and the current year that is 2018. It was observed that during year 2017, almost 230000 malware samples were produced daily and around 4000 ransomware attacks threatened the organizations. Year 2017 also saw a sharp increase in the amount of fileless malware attacks, which grew by approximately 50% in 2017. Fileless malwares poses a threat to organizations and a big challenge for the information security professionals, mainly due to its use of different non-executable file formats for infection. Therefore, it becomes very difficult to detect such threats. These threats also pose challenge for detection due to its ability to execute its malicious logic exclusively in memory. This paper analyses in detail the file less malwares along with the similar volatile threats. As a solution, a tool has been proposed which can be useful in detecting such threat factors.

An approach through gene-engineered animals

The everlasting increase in usage of information systems and online services have triggered the birth of the new type of malware which are more dangerous and hard to detect. In particular, according to the recent reports, the new type of fileless malware infect the victims’ devices without a persistent trace (i.e. file) on hard drives. Moreover, existing static malware detection methods in literature often fail to detect sophisticated malware utilizing various obfuscation and encryption techniques. Our contribution in this study is two-folded. First, we present a novel approach to recognize malware by capturing the memory dump of suspicious processes which can be represented as a RGB image. In contrast to the conventional approaches followed by static and dynamic methods existing in the literature, we aimed to obtain and use memory data to reveal visual patterns that can be classified by employing computer vision and machine learning methods in a multi-class open-set recognition regime. And second, we have applied a state of art manifold learning scheme named UMAP to improve the detection of unknown malware files through binary classification. Throughout the study, we have employed our novel dataset covering 4294 samples in total, including 10 malware families along with the benign executables. Lastly, we obtained their memory dumps and converted them to RGB images by applying 3 different rendering schemes. In order to generate their signatures (i.e. feature vectors), we utilized GIST and HOG (Histogram of Gradients) descriptors as well as their combination. Moreover, the obtained signatures were classified via machine learning algorithms of j48, RBF kernel-based SMO, Random Forest, XGBoost and linear SVM. According to the results of the first phase, we have achieved prediction accuracy up to 96.39% by employing SMO algorithm on the feature vectors combined with GIST+HOG. Besides, the UMAP based manifold learning strategy has improved accuracy of the unknown malware recognition models up to 12.93%, 21.83%, 20.78% on average for Random Forest, linear SVM and XGBoost algorithms respectively. Moreover, on a commercially available standard desktop computer, the suggested approach takes only 3.56 s for analysis on average. The results show that our vision based scheme provides an effective protection mechanism against malicious applications.