Malware Classification Research Articles

Enhancing Real-Time Malware Analysis with Quantum Neural Networks

The proposed Quantum Neural Networks (QNN) perform better than traditional machine learning models. The escalating complexity of malware poses a significant challenge to cybersecurity, necessitating innovative approaches to keep pace with its rapid evolution. Contemporary malware analysis techniques underscore the urgent need for solutions that can adapt to the dynamic functionalities of evolving malware. In this context, Quantum Neural Networks (QNNs) emerge as a cutting-edge and distinctive approach to malware analysis, promising to overcome the limitations of conventional methods. Our exploration of QNNs focuses on uncovering their valuable applications, particularly in real-time malware research. We meticulously examine the advantages of QNNs in contrast to conventional machine-learning methods employed in malware detection and classification. The proposed QNN showcases its unique capability to handle complex patterns, emphasizing its potential to achieve heightened levels of accuracy. Our contribution extends to introducing a dedicated framework for QNN-based malware analysis, harnessing the formidable computational capabilities of quantum computing for real-time malware analysis. This framework is structured around three pivotal components, Malware Feature Extraction utilizes quantum feature extraction techniques to identify relevant features from malware samples. Malware Classification employs a QNN classifier to categorize malware samples as benign or malicious. Real-Time Analysis enables the instantaneous examination of malware samples by integrating feature extraction and classification within a streaming data pipeline. Our proposed methodology undergoes comprehensive evaluation using a benchmark dataset of malware samples. The Proposed Quantum Neural Networks (QNNs) demonstrated a high accuracy of 0.95, outperforming other quantum models such as Quantum Support Vector Machines (QSVM) and Quantum Decision Trees (QDT), as well as classical models like Random Forest (RF), Support Vector Machines (SVM), and Decision Trees (DT) on the Malware DB dataset. The results affirm the framework's exceptional accuracy rates and low latency, establishing its suitability for real-time malware analysis. These findings underscore the potential for QNNs to revolutionize malware evaluation and strengthen real-time defenses against cyberattacks. While our research demonstrates promising outcomes, further exploration and development in this domain are imperative to fully exploit the extensive viability that QNNs offer for cybersecurity applications.

Predicting Malware Classification and Family using Machine Learning: A Cuckoo Environment Approach with Automated Feature Selection

Malware’s increasing menace in the digital realm needs the development of powerful detection and classification systems. This study presents a unique method for predicting malware category and family using machine learning, leveraging the Cuckoo environment and automated feature selection. To undertake an exhaustive examination of malware activity, we combined the Cuckoo environment with cutting-edge machine learning methods, such as the k-Nearest Neighbors (KNN) technique. The dynamic analysis of malware samples within the Cuckoo environment, which captured their interactions with the execution environment, provided remarkable insights into their malicious behaviors. The Boruta method aided automated feature selection, improving the feature set and optimizing model performance. A comparison with existing models yielded striking findings. Notably, Test Case 3 surpassed earlier cases by incorporating Automated Feature Selection + Cross-Validation. In identifying phishing attempts, it displayed outstanding specificity (90%), precision (93%), recall (96%), and an impressive F1-Score (92%), indicating its proficiency in reliably recognizing this frequent threat. Test Case 3 showed considerable increases as well, with a surprising 7.0% increase in precision and a notable 14.6% increase in recall when compared to Test Case 1. Furthermore, in the field of ransomware detection, Test Case 4, which solely focused on Automated Feature Selection, obtained excellent results, with 91% specificity, 92% accuracy, and a recall rate of 93%. These developments highlight the importance of the Boruta algorithm in optimizing the model’s performance.

Employing combined spatial and frequency domain image features for machine learning-based malware detection

<p>The ubiquitous adoption of Android devices has unfortunately brought a surge in malware threats, compromising user data, privacy concerns, and financial and device integrity, to name a few. To combat this, numerous efforts have explored automated botnet detection mechanisms, with anomaly-based approaches leveraging machine learning (ML) gaining attraction due to their signature-agnostic nature. However, the problem lies in devising accurate ML models which capture the ever evolving landscape of malwares by effectively leveraging all the possible features from Android application packages (APKs).This paper delved into this domain by proposing, implementing, and evaluating an image-based Android malware detection (AMD) framework that harnessed the power of feature hybridization. The core idea of this framework was the conversion of text-based data extracted from Android APKs into grayscale images. The novelty aspect of this work lied in the unique image feature extraction strategies and their subsequent hybridization to achieve accurate malware classification using ML models. More specifically, four distinct feature extraction methodologies, namely, Texture and histogram of oriented gradients (HOG) from spatial domain, and discrete wavelet transform (DWT) and Gabor from the frequency domain were employed to hybridize the features for improved malware identification. To this end, three image-based datasets, namely, Dex, Manifest, and Composite, derived from the information security centre of excellence (ISCX) Android Malware dataset, were leveraged to evaluate the optimal data source for botnet classification. Popular ML classifiers, including naive Bayes (NB), multilayer perceptron (MLP), support vector machine (SVM), and random forest (RF), were employed for the classification task. The experimental results demonstrated the efficacy of the proposed framework, achieving a peak classification accuracy of 93.03% and recall of 97.1% for the RF classifier using the Manifest dataset and a combination of Texture and HOG features. These findings validate the proof-of-concept and provide valuable insights for researchers exploring ML/deep learning (DL) approaches in the domain of AMD.</p>

Explainable Machine Learning for Malware Detection on Android Applications

The presence of malicious software (malware), for example, in Android applications (apps), has harmful or irreparable consequences to the user and/or the device. Despite the protections app stores provide to avoid malware, it keeps growing in sophistication and diffusion. In this paper, we explore the use of machine learning (ML) techniques to detect malware in Android apps. The focus is on the study of different data pre-processing, dimensionality reduction, and classification techniques, assessing the generalization ability of the learned models using public domain datasets and specifically developed apps. We find that the classifiers that achieve better performance for this task are support vector machines (SVM) and random forests (RF). We emphasize the use of feature selection (FS) techniques to reduce the data dimensionality and to identify the most relevant features in Android malware classification, leading to explainability on this task. Our approach can identify the most relevant features to classify an app as malware. Namely, we conclude that permissions play a prominent role in Android malware detection. The proposed approach reduces the data dimensionality while achieving high accuracy in identifying malware in Android apps.

Enhanced Image-Based Malware Classification Using Snake Optimization Algorithm With Deep Convolutional Neural Network

Enhanced Image-Based Malware Classification Using Snake Optimization Algorithm With Deep Convolutional Neural Network

Modelling an Improved Swarm Optimizer and Boosted Quantile Estimator For Malicious Flow Monitoring And Prediction In Network

For a long time, malware has posed a significant risk to computer system security. The effectiveness of conventional detection techniques based on static and dynamic analysis is restricted due to the quick advancement of anti-detection technologies. In recent years, AI-based malware detection has increasingly been employed to combat malware due to its improved predictive ability. Unfortunately, because malware may be so diverse, it can be challenging to extract features from it, which makes using AI for malware detection ineffective. A malware classifier based on an Improved Salp Swarm optimization for feature selection and a Boosted tree with Conditional Quantile Estimation (ISSO-BCQE) is developed to adapt different malware properties to solve the problem. Specifically, the malware code is extracted, and the feature sequence is generated into a boosting tree where the feature map of the node is extracted using BCQE, where a boosting network is used to design a classifier and the method's performance is finally analyzed and compared. The results show that our model works better than other approaches regarding FPR and accuracy. It also shows that the method beats current methods with the highest accuracy of 99.6% in most detecting circumstances. It is also stable in handling malware growth and evolution.

Obfuscated Privacy Malware Classifiers Based on Memory Dumping Analysis

Obfuscated Privacy Malware Classifiers Based on Memory Dumping Analysis

Securing Cyberspace: Exploring the Efficacy of SVM (Poly, Sigmoid) and ANN in Malware Analysis

This study presents a comprehensive exploration and comparative analysis of three prominent classification algorithms—Support Vector Machine (SVM) with polynomial and sigmoid kernels, and Artificial Neural Network (ANN)—in the context of malware classification. Leveraging a dataset comprising 5184 samples, including both malware and benign instances, the research systematically evaluates the performance of these algorithms using key metrics such as accuracy, precision, recall, F1 score, and AUC-ROC. The SVM classifier with a polynomial kernel emerges as the top performer, achieving remarkable accuracy (98.08%), precision (98.56%), and recall (97.85%). Its capacity to minimize false positives while maintaining a high true positive rate positions it as a robust tool for accurate malware identification. The sigmoid kernel SVM demonstrates a well-balanced performance, suitable for scenarios requiring a nuanced trade-off between false positives and false negatives. The ANN model, while exhibiting a lower overall accuracy (89.00%), excels in recall (92.61%), showcasing its proficiency in capturing instances of malware. The study underscores the significance of selecting an algorithm aligned with specific application requirements, whether prioritizing precision, recall, or a balanced approach. Furthermore, the research acknowledges the dataset's limitations and calls for future exploration with diverse datasets and additional preprocessing techniques. As cybersecurity threats evolve, the insights provided by this study contribute to the ongoing discourse on developing robust tools for effective malware detection. The findings empower cybersecurity professionals and researchers with valuable considerations for selecting the most suitable classification algorithm in the dynamic landscape of digital security.

An empirical study of problems and evaluation of IoT malware classification label sources

With the proliferation of malware on IoT devices, research on IoT malicious code has also become more mature. Most studies use learning models to detect or classify malware. Therefore, ensuring high-quality labels for malware samples is crucial to maintaining research accuracy. Researchers typically submit malware samples to Anti-Virus (AV) engines to obtain labels, but different engines have varying rules for detecting maliciousness and variants. This study aims to improve future IoT malware research accuracy by investigating label quality. We address three label-related issues, including Anti-Virus detection technology, naming rules, and label expiration. Additionally, we examine multiple sources of malware labels, including 63 studies on IoT, Windows, and Android malware, as well as commonly used tools such as AVClass and Anti-Virus engines. To evaluate and recommend label sources, we construct classification models using an IoT malware dataset obtained from VirusShare, which is labeled with common tools and Anti-Virus engines and classified based on ELF features. For family classification, we investigate four methods and tools, and for variant hierarchy classification, we compare label overlaps with sample clustering from 12 Anti-Virus engines. Based on our findings, we recommend AVClass for obtaining labels for IoT family classification. For small-scale malware families at the variant level, we recommend using the labels from Ad-Aware, BitDefender, and Emsisoft engines. For large-scale malware families, we advise employing labels from Jiangmin, NANO-Antivirus, and Avira engines, serving as a valuable guide for future IoT malware research.

TTDAT: Two-Step Training Dual Attention Transformer for Malware Classification Based on API Call Sequences

The surge in malware threats propelled by the rapid evolution of the internet and smart device technology necessitates effective automatic malware classification for robust system security. While existing research has primarily relied on some feature extraction techniques, issues such as information loss and computational overhead persist, especially in instruction-level tracking. To address these issues, this paper focuses on the nuanced analysis of API (Application Programming Interface) call sequences between the malware and system and introduces TTDAT (Two-step Training Dual Attention Transformer) for malware classification. TTDAT utilizes Transformer architecture with original multi-head attention and an integrated local attention module, streamlining the encoding of API sequences and extracting both global and local patterns. To expedite detection, we introduce a two-step training strategy: ensemble Transformer models to generate class representation vectors, thereby bolstering efficiency and adaptability. Our extensive experiments demonstrate TTDAT’s effectiveness, showcasing state-of-the-art results with an average F1 score of 0.90 and an accuracy of 0.96.

Zero-Day Malware Classification and Detection Using Machine Learning

Zero-Day Malware Classification and Detection Using Machine Learning

Tree-Based Learning Models for Botnet Malware Classification in Real World Sub-Sample Dataset

The use of machine learning techniques for botnet detection has been an active area of research in security field for some years now. Some of the past machine learning-based botnet detection studies used datasets that were generated synthetically. The release of a large and real-life botnet dataset, named CTU-13, allowed researchers to build machine learning-based models from real-world data. In fact, the real-life traces in the dataset makes it more promising for being used for botnet identification studies. The current study proposed the use of a single tree-based learning algorithm in the classification of botnet evidence from sub-sampled portion of three captures in CTU-13 dataset. Random sub-sampling was used to arrive at three different datasets that was used in the study. The first step in the methodology involved experimental analyses on three captures out of thethirteen in the whole dataset. The analyses revealed the basic characteristics of the datasets which further guided the study further. The missing values and categorical data types in the dataset were handled through mixed imputation and feature encoding, respectively. The big data nature of the dataset was handled through random sub-sampling technique with a view to building a botnet detection model that is less computationally intensive. The random sub-sampling technique was used without changing the data distributions in thedataset. The botnet detection models were built by using decision-tree algorithm from the three sub-sampled dataset captures. The performances of the models were evaluated by using accuracy, precision, recall, and f1-score, respectively. In all, the model built with scenario5 capture slightly performed better than the ones built using scenario 6 and scenario 7 captures, respectively.

Improve malware classifiers performance using cost-sensitive learning for imbalanced dataset

<p>In recent times, malware visualization has become very popular for malware<br />classification in cybersecurity. Existing malware features can easily identify<br />known malware that have been already detected, but they cannot identify new<br />and infrequent malwares accurately. Moreover, deep learning algorithms<br />show their power in term of malware classification topic. However, we found<br />the use of imbalanced data; the Malimg database which contains 25 malware<br />families don’t have same or near number of images per class. To address these<br />issues, this paper proposes an effective malware classifier, based on costsensitive deep learning. When performing classification on imbalanced data, some classes get less accuracy than others. Cost-sensitive is meant to solve this issue, however in our case of 25 classes, classical cost-sensitive weights wasn’t effective is giving equal attention to all classes. The proposed approach improves the performance of malware classification, and we demonstrate this improvement using two Convolutional Neural Network models using functional and subclassing programming techniques, based on loss, accuracy, recall and precision.</p>

Android-manifest extraction and labeling method for malware compilation and dataset creation

<div align="center"><span lang="EN-US">Malware is a nuisance for smartphone users. The impact is detrimental to smartphone users if the smartphone is infected by malware. Malware identification is not an easy process for ordinary users due to its deeply concealed dangers in application package kit (APK) files available in the Android Play Store. In this paper, the challenges of creating malware datasets are discussed. Long before a malware classification process and model can be built, the need for datasets with representative features for most types of <span>malwares has to be addressed systematically. Only after a quality data set is available can a quality classification model be obtained using machine learning (ML) or deep learning (DL) algorithms. The entire malware classification process is</span> a full pipeline process and sub processes. The authors purposefully focus on the process of building quality malware datasets, not on ML itself, because implementing ML requires another effort after the reliable dataset is fully built. The overall step in creating the malware dataset starts with the extraction of the Android Manifest from the APK file set and ends with the labeling method for all the extracted APK files. The key contribution of this paper is on how to generate datasets systematically from any APK file.</span></div>

A Neural Network Approach to a Grayscale Image-Based Multi-File Type Malware Detection System

This study introduces an innovative all-in-one malware identification model that significantly enhances convenience and resource efficiency in classifying malware across diverse file types. Traditional malware identification methods involve the extraction of static and dynamic features, followed by comparisons with signature-based databases or machine learning-based classifiers. However, many malware detection applications that rely on transfer learning and image transformation suffer from excessive resource consumption. In recent years, transfer learning has emerged as a powerful tool for developing effective classifiers, leveraging pre-trained neural network models. In this research, we comprehensively explore various pre-trained network architectures, including compact and conventional networks, as well as series and directed acyclic graph configurations for malware classification. Our approach utilizes grayscale transform-based features as a standardized set of characteristics, streamlining malware classification across various file types. To ensure the robustness and generalization of our classification models, we integrate multiple datasets into the training process. Remarkably, we achieve an optimal model with 96% accuracy, while maintaining a modest 5 MB size using the SqueezeNet classifier. Overall, our model efficiently classifies malware across file types, reducing the computational load, which can be useful for cybersecurity professionals and organizations.

Android Malware Classification Based on Fuzzy Hashing Visualization

The proliferation of Android-based devices has brought about an unprecedented surge in mobile application usage, making the Android ecosystem a prime target for cybercriminals. In this paper, a new method for Android malware classification is proposed. The method implements a convolutional neural network for malware classification using images. The research presents a novel approach to transforming the Android Application Package (APK) into a grayscale image. The image creation utilizes natural language processing techniques for text cleaning, extraction, and fuzzy hashing to represent the decompiled code from the APK in a set of hashes after preprocessing, where the image is composed of n fuzzy hashes that represent an APK. The method was tested on an Android malware dataset with 15,493 samples of five malware types. The proposed method showed an increase in accuracy compared to others in the literature, achieving up to 98.24% in the classification task.

MIGAN: GAN for facilitating malware image synthesis with improved malware classification on novel dataset

Malware visualization is a technique wherein malware binaries are represented as grayscale or color images in order to identify and extract discriminating features for classification. This technique is effectively better than classic machine learning based malware recognition techniques that require significant domain expertise or time-consuming behavioral analysis to identify discriminating features. In this manuscript, a Generative Adversarial Network (GAN) architecture is introduced for facilitating malware image synthesis called ‘MIGAN’, that can quickly produce high-quality synthetic malware images and then classify malware samples into families. The proposed framework consists of a generator and discriminator network paired with a classification module. The novelty exists in the GAN network structure, hybrid loss function, new dataset and classification network structure. The MIGAN generated images manage to achieve better Inception Score than original malware images (2.81 vs 1.90, respectively) along with better Fréchet Inception Distance score and Kernel Inception Distance score. The synthetic malware images primarily serve two purposes: firstly, it solves the class imbalance problem in custom built and public ‘Malimg’ datasets. Secondly, since these images resemble existing malware images, it is assessed to be fairly similar to upcoming ‘zero-day’ or ‘previously unseen’malware that can be eventually discovered in the future. The two classification networks (custom classification network with traditional learning approach and pretrained Resnet50v2 network with transfer learning approach) were supplemented and trained with nearly 50,000 synthetic malware images. The proposed framework achievedpromising scores of 99.2 % Area Under the Curve (AUC), 99.3 % F1-scoreand 99.5 % Accuracy. The comprehensive evaluation and excellent results demonstrate the effectiveness of the proposed framework. This framework can also be applied to image synthesis with several other types of images.

From malware samples to fractal images: A new paradigm for classification

To date, a large number of research papers have been written on malware classification, identification, classification into different families, and the distinction between malware and goodware. These works have been based on captured malware samples and have attempted to analyse malware and goodware using various techniques like the analysis of malware using malware visualization. These works usually convert malware samples capturing the malware structure into image structures which are then subject to image processing. In this paper, we propose an unconventional and novel approach to malware visualization based on its dynamical analysis, subsequent complex network conversion and fractal geometry, e.g. Julia sets visualization. Very interesting images being subsequently used to classify as malware and goodware. The classification is done by deep learning network. The results of the presented experiments of fractal conversion and subsequent classification are based on a database of 6,589,997 goodware, 827,853 potentially unwanted applications and 4,174,203 malware samples provided by ESET.11https://www.eset.com. This paper aims to show a new direction in visualizing malware using fractal geometry and possibilities in analysis and classification.

SynDroid: An adaptive enhanced Android malware classification method based on CTGAN-SVM

Android mobile phones have the highest market share nowadays, bringing a boom of Android application programming as well as malicious software (malware) issues. Traditional machine learning and deep learning methods are widely used in Android malware detection and classification, both require plenty of application samples to train classifiers. However, the collected samples are always imbalanced, because the distribution of malware categories differs hugely in the real environment. For Android malware samples with high dimension features, and Class Imbalance Ratio coming to more than 100:1, traditional methods become weak. To fill the gap, we propose an Android malware classification model named SynDroid. The core step of SynDroid uses CTGAN-SVM to generate qualified high-dimension samples, and adaptively discards bad results. Besides, we propose KS-CIR test to help the model to determine which classes of data needed to be enhanced most. This new proposed test can measure the data in respect of both samples' quality and quantity. Lastly, Random Forest is taken as a classifier to finish the classification task. The performance of SynDroid is evaluated on CCCS-CIC-AndMal2020 on the accuracy, precision, recall and F1-score. Both longitudinal and horizontal comparison experiments have been done with traditional oversampling methods, cost-sensitive learning, and other complicated methods. The result shows that the proposed method gets 12% more accuracy than the method on the same dataset and alleviates imbalanced data problems.

FACILE: A capsule network with fewer capsules and richer hierarchical information for malware image classification

The struggle between security researchers and malware perpetuates an endless arms race. Recent studies indicate that converting malware into grayscale images and using convolutional neural network or capsule network to classify and identify them is a promising approach. Nonetheless, training convolutional neural networks demands a significant amount of data and parameters, posing a challenge to obtaining enough training samples for malware detection tasks, particularly for new malware families. Additionally, a high number of parameters translates to low classification efficiency. Capsule networks offer a promising approach to achieve higher-level feature representations through dynamic routing between capsules, but research on capsule networks is still nascent, and there are two major challenges for malware classification tasks: the huge number of parameters, which makes model training difficult, and capsules shedding, which results in information loss during routing. To address these issues, we propose a capsule network called FACILE that uses fewer capsules and richer hierarchical information. In the initial feature extraction stage, we perform multi-level feature extraction and fusion using dynamic convolution. In the routing phase, we introduce balance coefficients to enhance the model's representational power and stabilize the training process. We conducted experiments on the VIRUS-MNIST, MalImg, and BIG2015 datasets and found that FACILE requires only 8.1% of the capsules and 1.8%-3.3% of the parameters compared to the original CapsNet, while reducing the error rate to 8.087%, 1.149%, and 2.797%, respectively. Furthermore, FACILE demonstrates competitive performance with a small number of parameters as the training samples decrease compared to convolutional neural network-based models such as ResNet, EfficientNet, and VGG.