Malware Identification Research Articles

Evaluating Malware Detection System using Machine Learning Algorithms

Malware, is any program or document that is unsafe to a PC client. Kinds of malware can incorporate PC infections, worms, Trojan ponies and spyware. These noxious projects can play out an assortment of capacities like taking, scrambling or erasing touchy information, adjusting or commandeering center processing capacities and observing clients' PC action. Malware identification is the way toward checking the PC and documents to distinguish malware. It is viable at distinguishing malware on the grounds that it includes numerous instruments and approaches. It's anything but a single direction measure, it's very intricate. The beneficial thing is malware identification and evacuation take under 50 seconds as it were. The outstanding development of malware is representing an extraordinary risk to the security of classified data. The issue with a significant number of the current order calculations is their small presentation in term of their capacity to identify and forestall malware from tainting the PC framework. There is a critical need to assess the exhibition of the current Machine Learning characterization calculations utilized for malware identification. This will help in making more hearty and productive calculations that have the ability to conquer the shortcomings of the current calculations. As of late, AI methods have been the main focus of the security specialists to distinguish malware and foresee their families powerfully. Yet, to the best of our information, there exists no complete work that looks at and assesses a sufficient number of machine learning strategies for characterizing malware and favorable examples. In this work, we led a set of examinations to assess AI strategies for distinguishing malware and their classification into respective families powerfully. This investigation did the presentation assessment of some characterization calculations like J45, LMT, Naive Bayes, Random Forest, MLP Classifier, Random Tree, AdaBoost, KStar. The presentation of the calculations was assessed as far as Accuracy, Precision, Recall, Kappa Statistics, F-Measure, Matthew Correlation Coefficient, Receiver Operator Characteristics Area and Root Mean Squared Error utilizing WEKA AI and information mining recreation device. Our test results showed that Random Forest calculation delivered the best exactness of 99.2%. This decidedly shows that the Random Forest calculation accomplishes great precision rates in identifying malware.

Identifying the Author Group of Malwares through Graph Embedding and Human-in-the-Loop Classification

Malware are developed for various types of malicious attacks, e.g., to gain access to a user’s private information or control of the computer system. The identification and classification of malware has been extensively studied in academic societies and many companies. Beyond the traditional research areas in this field, including malware detection, malware propagation analysis, and malware family clustering, this paper focuses on identifying the “author group” of a given malware as a means of effective detection and prevention of further malware threats, along with providing evidence for proper legal action. Our framework consists of a malware-feature bipartite graph construction, malware embedding based on DeepWalk, and classification of the target malware based on the k-nearest neighbors (KNN) classification. However, our KNN classifier often faced ambiguous cases, where it should say “I don’t know” rather than attempting to predict something with a high risk of misclassification. Therefore, our framework allows human experts to intervene in the process of classification for the final decision. We also developed a graphical user interface that provides the points of ambiguity for helping human experts to effectively determine the author group of the target malware. We demonstrated the effectiveness of our human-in-the-loop classification framework via extensive experiments using real-world malware data.

Detecting Portable Executable Malware by Binary Code Using an Artificial Evolutionary Fuzzy LSTM Immune System

As the planet watches in shock the evolution of the COVID-19 pandemic, new forms of sophisticated, versatile, and extremely difficult-to-detect malware expose society and especially the global economy. Machine learning techniques are posing an increasingly important role in the field of malware identification and analysis. However, due to the complexity of the problem, the training of intelligent systems proves to be insufficient in recognizing advanced cyberthreats. The biggest challenge in information systems security using machine learning methods is to understand the polymorphism and metamorphism mechanisms used by malware developers and how to effectively address them. This work presents an innovative Artificial Evolutionary Fuzzy LSTM Immune System which, by using a heuristic machine learning method that combines evolutionary intelligence, Long-Short-Term Memory (LSTM), and fuzzy knowledge, proves to be able to adequately protect modern information system from Portable Executable Malware. The main innovation in the technical implementation of the proposed approach is the fact that the machine learning system can only be trained from raw bytes of an executable file to determine if the file is malicious. The performance of the proposed system was tested on a sophisticated dataset of high complexity, which emerged after extensive research on PE malware that offered us a realistic representation of their operating states. The high accuracy of the developed model significantly supports the validity of the proposed method. The final evaluation was carried out with in-depth comparisons to corresponding machine learning algorithms and it has revealed the superiority of the proposed immune system.

An Approach Based on the Improved SVM Algorithm for Identifying Malware in Network Traffic

Due to the growth and popularity of the internet, cyber security remains, and will continue, to be an important issue. There are many network traffic classification methods or malware identification approaches that have been proposed to solve this problem. However, the existing methods are not well suited to help security experts effectively solve this challenge due to their low accuracy and high false positive rate. To this end, we employ a machine learning-based classification approach to identify malware. The approach extracts features from network traffic and reduces the dimensionality of the features, which can effectively improve the accuracy of identification. Furthermore, we propose an improved SVM algorithm for classifying the network traffic dubbed Optimized Facile Support Vector Machine (OFSVM). The OFSVM algorithm solves the problem that the original SVM algorithm is not satisfactory for classification from two aspects, i.e., parameter optimization and kernel function selection. Therefore, in this paper, we present an approach for identifying malware in network traffic, called Network Traffic Malware Identification (NTMI). To evaluate the effectiveness of the NTMI approach proposed in this paper, we collect four real network traffic datasets and use a publicly available dataset CAIDA for our experiments. Evaluation results suggest that the NTMI approach can lead to higher accuracy while achieving a lower false positive rate compared with other identification methods. On average, the NTMI approach achieves an accuracy of 92.5% and a false positive rate of 5.527%.

A Mobile Malware Detection Method Based on Malicious Subgraphs Mining

As mobile phone is widely used in social network communication, it attracts numerous malicious attacks, which seriously threaten users’ personal privacy and data security. To improve the resilience to attack technologies, structural information analysis has been widely applied in mobile malware detection. However, the rapid improvement of mobile applications has brought an impressive growth of their internal structure in scale and attack technologies. It makes the timely analysis of structural information and malicious feature generation a heavy burden. In this paper, we propose a new Android malware identification approach based on malicious subgraph mining to improve the detection performance of large-scale graph structure analysis. Firstly, function call graphs (FCGs), sensitive permissions, and application programming interfaces (APIs) are generated from the decompiled files of malware. Secondly, two kinds of malicious subgraphs are generated from malware’s decompiled files and put into the feature set. At last, test applications’ safety can be automatically identified and classified into malware families by matching their FCGs with malicious structural features. To evaluate our approach, a dataset of 11,520 malware and benign applications is established. Experimental results indicate that our approach has better performance than three previous works and Androguard.

Efficiency of Malware Detection in Android System: A Survey

Smart phones are becoming essential in our lives, and Android is one of the most popular operating systems. Android OS is wide-ranging in the mobile industry today because of its open-source architecture. It is a wide variety of applications and basic features. App users tend to trust Android OS to secure data, but it has been shown that Android is more vulnerable and unstable. Identification of Android OS malware has become an emerging research subject of concern. This paper aims to analyze the various characteristics involved in malware detection. It also addresses malware detection methods. The current detection mechanism utilizes algorithms such as Bayesian algorithm, Ada grad algorithm, Naïve Bayes algorithm, Hybrid algorithm, and other algorithms for machine learning to train the sets and find the malware.

Deep Cybersecurity: A Comprehensive Overview from Neural Network and Deep Learning Perspective

Deep learning, which is originated from an artificial neural network (ANN), is one of the major technologies of today’s smart cybersecurity systems or policies to function in an intelligent manner. Popular deep learning techniques, such as multi-layer perceptron, convolutional neural network, recurrent neural network or long short-term memory, self-organizing map, auto-encoder, restricted Boltzmann machine, deep belief networks, generative adversarial network, deep transfer learning, as well as deep reinforcement learning, or their ensembles and hybrid approaches can be used to intelligently tackle the diverse cybersecurity issues. In this paper, we aim to present a comprehensive overview from the perspective of these neural networks and deep learning techniques according to today’s diverse needs. We also discuss the applicability of these techniques in various cybersecurity tasks such as intrusion detection, identification of malware or botnets, phishing, predicting cyberattacks, e.g. denial of service, fraud detection or cyberanomalies, etc. Finally, we highlight several research issues and future directions within the scope of our study in the field. Overall, the ultimate goal of this paper is to serve as a reference point and guidelines for the academia and professionals in the cyber industries, especially from the deep learning point of view.

Classification and Analysis of Android Malware Images Using Feature Fusion Technique

The super packed functionalities and artificial intelligence (AI)-powered applications have made the Android operating system a big player in the market. Android smartphones have become an integral part of life and users are reliant on their smart devices for making calls, sending text messages, navigation, games, and financial transactions to name a few. This evolution of the smartphone community has opened new horizons for malware developers. As malware variants are growing at a tremendous rate every year, there is an urgent need to combat against stealth malware techniques. This paper proposes a visualization and machine learning-based framework for classifying Android malware. Android malware applications from the DREBIN dataset were converted into grayscale images. In the first phase of the experiment, the proposed framework transforms Android malware into fifteen different image sections and identifies malware files by exploiting handcrafted features associated with Android malware images. The algorithms such as Gray Level Co-occurrence Matrix-based (GLCM), Global Image deScripTors (GIST), and Local Binary Pattern (LBP) are used to extract the handcrafted features from the image sections. The extracted features were further classified using machine learning algorithms like K-Nearest Neighbors, Support Vector Machines, and Random Forests. In the second phase of the experiment, handcrafted features were fused with CNN features to form the feature fusion strategy. The classification performance was evaluated against every malware image file section. The results obtained using the Feature Fusion strategy are compared with handcrafted features results. The experiment results conclude to the fact that Feature Fusion-SVM model is most suited for the identification and classification of Android malware using the certificate and Android Manifest (CR + AM) malware images. It attained an high accuracy of 93.24%.

Deep Feature Extraction and Classification of Android Malware Images.

The Android operating system has gained popularity and evolved rapidly since the previous decade. Traditional approaches such as static and dynamic malware identification techniques require a lot of human intervention and resources to design the malware classification model. The real challenge lies with the fact that inspecting all files of the application structure leads to high processing time, more storage, and manual effort. To solve these problems, optimization algorithms and deep learning has been recently tested for mitigating malware attacks. This manuscript proposes Summing of neurAl aRchitecture and VisualizatiOn Technology for Android Malware identification (SARVOTAM). The system converts the malware non-intuitive features into fingerprint images to extract the quality information. A fine-tuned Convolutional Neural Network (CNN) is used to automatically extract rich features from visualized malware thus eliminating the feature engineering and domain expert cost. The experiments were done using the DREBIN dataset. A total of fifteen different combinations of the Android malware image sections were used to identify and classify Android malware. The softmax layer of CNN was substituted with machine learning algorithms like K-Nearest Neighbor (KNN), Support Vector Machine (SVM), and Random Forest (RF) to analyze the grayscale malware images. It is observed that CNN-SVM model outperformed original CNN as well as CNN-KNN, and CNN-RF. The classification results showed that our method is able to achieve an accuracy of 92.59% using Android certificates and manifest malware images. This paper reveals the lightweight solution and much precise option for malware identification.

Securing IoT Devices Using Dynamic Power Management: Machine Learning Approach

The shift in paradigm from cloud computing toward edge has resulted in faster response times, a more secure and energy-efficient edge. Internet-of-Things (IoT) devices form a vital part of the edge, but despite legions of benefits it offers, increasing vulnerabilities and escalation in malware generation has rendered them insecure. Software-based approaches are prominent in malware detection, but they fail to meet the requirements for IoT devices. Dynamic power management (DPM) is architecture agnostic and inherently pervasive component existing in all low-power IoT devices. In this article, we demonstrate dynamic voltage and frequency scaling (DVFS) states form a signature pertinent to an application, and its runtime variations comprise of features essential for securing IoT devices against malware attacks. We have demonstrated this proof of concept by performing experimental analysis on a Snapdragon 820 mobile processor, hosting the Android operating system (OS). We developed a supervised machine learning model for application classification and malware identification by extracting features from the DVFS states time series. The experimental results show $> 0.7~F1$ score in classifying different android benchmarks and >0.88 in classifying benign and malware applications when evaluated across different DVFS governors. We also performed power measurements under different governors to evaluate power-security aware governor. We have observed higher detection accuracy and lower power dissipation under settings of the ondemand governor.

Exploring Malware Behavior of Webpages Using Machine Learning Technique: An Empirical Study

Malware is one of the most common security threats experienced by a user when browsing webpages. A good understanding of the features of webpages (e.g., internet protocol, port, URL, Google index, and page rank) is required to analyze and mitigate the behavior of malware in webpages. This main objective of this paper is to analyze the key features of webpages and to mitigate the behavior of malware in webpages. To this end, we conducted an empirical study to identify the features that are most vulnerable to malware attacks and its results are reported. To improve the feature selection accuracy, a machine learning technique called bagging is employed using the Weka program. To analyze these behaviors, phishing and botnet data were obtained from the University of California Irvine machine learning repository. We validate our research findings by applying honeypot infrastructure using the Modern Honeypot Network (MHN) setup in a Linode Server. As the data suffer from high variance in terms of the type of data in each row, bagging is chosen because it can classify binary classes, date classes, missing values, nominal classes, numeric classes, unary classes and empty classes. As a base classifier of bagging, random tree was applied because it can handle similar types of data such as bagging, but better than other classifiers because it is faster and more accurate. Random tree had 88.22% test accuracy with the lowest run time (0.2 sec) and a receiver operating characteristic curve of 0.946. Results show that all features in the botnet dataset are equally important to identify the malicious behavior, as all scored more than 97%, with the exception of TCP and UDP. The accuracy of phishing and botnet datasets is more than 89% on average in both cross validation and test analysis. Recommendations are made for the best practice that can assist in future malware identification.

Malware detection in industrial internet of things based on hybrid image visualization and deep learning model

Now the Industrial Internet of Things (IIoT) devices can be deployed to monitor the flow of data, the source of collection and supervision on a large scale of complex networks. It implements large networks for sending and receiving data connected by smart devices. Malware threats, which are primarily targeted at conventional computers linked to the Internet, can also be targeted at IoT machines. Therefore, a smart protection approach is needed to protect millions of IIoT users against malicious attacks. On the other hand, existing state-of - the-art malware identification methods are not better in terms of computational complexity. In this paper, we design architecture to detect malware attacks on the Industrial Internet of Things (MD-IIOT). For an in-depth analysis of malware, a methodology is proposed based on color image visualization and deep convolution neural network. The findings of the proposed method are compared to former approaches to malware detection. The experimental results indicate that the proposed method's predictive time and detection accuracy are higher than that of previous machine learning and deep learning methods.

Malware Detection using Deep Learning Methods

Rapid development of the internet leads the malware to become one of the most significant threads nowadays. Malware, is any kind of program or file which would adversely affect the computer users in a harmful way. Malware exist in different forms which includes worms, viruses in computer, Trojan horses, etc. These malicious contents can degrade the overall performance of the system. It includes activities like stealing, encrypting or deleting sensitive data, etc. without the consent of the user. Malware detection is a milestone in the field of computer security. For detecting malware many methods have been evolved. Researchers are mainly concentrated in malware identification methods based on machine learning. Malware can be detected in two ways. They are static approach and dynamic approach. This paper mainly deals with the current challenges faced by malware detection methods and also explores a categorized new method in machine learning. The methods discussed here are combined static and dynamic approach, random forest, Bayes classification. This work will help in cyber security area and also which will help the researchers to do efficient researches.

Metamorphic malware identification using engine-specific patterns based on co-opcode graphs

A metamorphic virus is a type of malware that modifies its code using a morphing engine. Morphing engines are used to generate a large number of metamorphic malware variants by performing different obfuscation techniques. Since each metamorphic malware has its own unique structure, signature based anti-virus programs are ineffective to detect these metamorphic variants. Therefore, detection of these kind of viruses becomes an increasingly important task. Recently, many researchers have focused on extracting common patterns of metamorphic variants that can be used as micro-signatures to identify the metamorphic malware executables. With the similar motivation, in this work, we propose a novel metamorphic malware identification method, named HLES-MMI (Higher-level Engine Signature based Metamorphic Malware Identification). The proposed method firstly constructs a unique graph structure, called as co-opcode graph, for each metamorphic family, then extracts engine-specific opcode patterns from the graphs. Finally, it generates higher-level signature belonging to each family by representing the extracted opcode-patterns with a binary vector. Experimental results on four datasets produced by different morphing engines demonstrate the effectiveness and efficiency of the proposed method by comparing with several existing malware identification methods.

Malware Detection Using Remedimorbus Application

As a huge number of new malware tests rise each day, traditional malware recognition strategies are not sufficient. Static examination strategies, for example, report signature, fail to recognize obscure projects. Dynamic examination techniques have low execution and over the top bogus positive charge. A discovery method that could adjust to the quickly changing malware condition is required. The paper introduced a spic and span malware identification approach the utilization of machine picking up information on. This paper proposes an answer where some of the gadget contemplating calculations are chosen. Utilizing the chose abilities, an incorporated methodology has been progressed with the picked calculations so the grouping and identification expense may improve contrasted with static and dynamic approach. The analyzed malwares equipped with various algorithms and capacities is utilized for higher order and discovery result. The final product got during utilizing calculations like Random woodland, Decision tree and Adaboost demonstrates a precision of 99.35% the use of the Random backwoods, 98.96% the use of Decision tree and 98.54% utilizing Adaboost. Looking at the static and dynamic strategy, this incorporated technique gives higher exactness.

Transforming Malware Behavioural Dataset for Deep Denoising Autoencoders

This research is a part of a major research on automation of malware identification using Deep Denoising Autoencoders. Malicious software, or in short called malware refers to any software designed to cause damage to a single computer, server, or computer network. This malware term includes all kind of malicious software such as computer virus and spyware. All these malicious malware behaviour is monitored, logged and recorded using a cuckoo sandbox with the help of an x86 hosted supervisor software. The intent of recording the malware behaviour is to understand the pattern of behaviour of each known malware family. This collected data will be further trained to a Deep Denoising Autoencoders to automate the identification process of new malware within the identified malware families. However, the raw behaviour data is not suitable for an optimum training process. This paper will discuss the process of transforming the text based behavioural dataset to a more suitable dataset for deep learning purposes. At the end of the research a cleaned bit string format that should represent a unique malware behaviour will be produced.

Advanced persistent threat organization identification based on software gene of malware

AbstractSince the concept of IoT (Internet of Things) was proposed, it has digitized the real world and has a wide range of applications. However, with tremendous evolution in data acquisition and transfer, a new type of attack represented by advanced persistent threat (APT) has attracted wide attention. APT organization identification for malware is a method to detect APT attacks. However, most of malware is tailored to the goal, it is complex and changeable, or can be updated very quickly. The traditional analysis method is difficult to obtain the source information of APT organization from the malware in the IoT. To this end, we propose a software genes method to solve this problem. Software gene is binary fragment of specific function or information in the software body. In this paper, different from traditional data flow and instruction flow, a new gene model is proposed which combine with knowledge graph of malware behavior. We fill the processed malware information into the gene model to obtain the APT organization gene pool. Of course, the gene pool should be optimized to include the genetic characteristics of APT. In theory, there genetic characteristics can help us identify malware and APT accurately in the IoT. However, biological genetic similarity algorithms cannot be used directly. A genetic similarity algorithm for APT organization identification of malware will be designed instead. Simulations on real‐world dataset corroborate theoretical analysis and reveal the possibility of using genes for malware traceability.

Malware Analysis in Web Application Security: An Investigation and Suggestion

Malware analysis is essentially used for the identification of malware and its objectives. However, the present era has seen the process of malware analysis being used for enhancing security methods for different domains of technology. This study has attempted to analyze the current situation and status of malware analysis in web application security through some objectives. These objectives helps the authors to analyze the purpose, used methodology of malware analysis in web application security previously as well as authors select and find a prioritized technique of malware analysis through a hybrid multi criteria decision making procedure called fuzzy-Analytical Hierarchy Process. This fuzzy-AHP methodology helps the authors to find and recommend a most prioritized malware analysis techniques and type as well as suggest a ranking of various malware analysis techniques that used in web application security frequently for experts and developers use. Furthermore, second section of paper forecast the attack statistics and publication statistics of malwares and malware analysis in web application security respectively for understanding the sensitivity of topic and need of investigation. The proposed tactic intends to be an effective reckoner for web developers and facilitate in malware analysis for securing web applications. Additionally, the study also forecast the publication and attack scenario of malware and malware analysis for web application security that gives a complimentary overview of domain.

A Dynamic DL-Driven Architecture to Combat Sophisticated Android Malware

The predominant Android operating system has captured enormous attention globally not only in smart phone industry but also for varied smart devices. The open architecture and application programming interfaces (APIs) while hosting third party applications has led to explosive growth of varied pervasive sophisticated Android malware production. In this study, we propose a robust, scalable and efficient Cuda-empowered multi-class malware detection technique leveraging Gated Recurrent Unit (GRU) to identify sophisticated Android malware. Experimentation of the proposed technique has been carried out using current state-of-the-art datasets of Android applications (i.e., Android Malware Dataset (AMD), Androzoo). Moreover, to rigorously evaluate the performance of the proposed technique, we have employed standard performance evaluation metrics (e.g., accuracy, precision, recall, F1-score etc.) and compared it with our constructed DL-driven architectures and benchmark algorithms. The GRU-based malware detection system outperforms with 98.99% detection accuracy for malware identification with a trivial trade off in speed efficiency.

An Effective Performance Based on Static and Dynamic Features to Detect Malware in Android by Machine Learning Algorithm

Android is dominating the smartphone market with more users than any other mobile operating system. Yet concern from hackers has also risen with its growing popularity, as the number of malicious applications remains to rise. Wide-ranging work on malware identification and prevention for Android devices has been carried out in recent years, although Android has also introduced numerous security measures to fix malware complications, containing Unique User ID (UID) for every request, software permissions, and its Google Play scattering platform. In our proposed work, incorporates the analysis of static and dynamic features of these applications with the goal of evaluating their actions by exploring different attributes such as authorization, use of CPUs and storage utilization. In this paper machine learning methods to evaluate the comparative efficiency of extracted static and dynamic features to identify AM. This results is quite powerful and demonstrates the AUC of 0.972 can be used to identify AM with a high degree of accuracy than the dynamic function.