Malware Detection Mechanism Research Articles

Static analysis framework for permission-based dataset generation and android malware detection using machine learning

Since Android is the popular mobile operating system worldwide, malicious attackers seek out Android smartphones as targets. The Android malware can be identified through a number of established detection techniques. However, the issues presented by modern malware cannot be met by traditional signature or heuristic-based malware detection methods. Previous research suggests that machine-learning classifiers can be utilised to analyse permissions, making it possible to differentiate between malicious and benign applications on the Android platform. There exist machine-learning methods that utilise permission-based attributes to build models for the detection of malware on Android devices. Nevertheless, the performance of these detection methods is dependent on the raw or feature datasets. Android malware research frequently faces a major obstacle due to the lack of adequate and up-to-date raw malware datasets. In this paper, we put forward a systematic approach to generate an Android permission-based dataset using static analysis. To create the dataset, we collect recent raw malware samples (APK files) and focus on the reverse engineering approach and permission-based features extraction. We also conduct a thorough feature analysis to determine the important Android permissions and present a machine-learning-based Android malware detection mechanism. The experimental result of our study demonstrates that with just 48 features, the random forest classifier-based Android malware detection model obtains the best accuracy of 97.5%.

Detection of Evasive Android Malware Using EigenGCN

Recently there is an upsurge in Android malware that use obfuscation and repackaging techniques for evasion. Malware may also combine both these techniques to create stealthy adversarial mimicry samples to launch mimicry attacks. In mimicry attacks, the adversary makes sure that the static and dynamic features present in the crafted malware mimics the features present in the legitimate applications. In such cases, the existing detection mechanisms may become less effective. We found that the malicious nature of Android applications can be determined by identifying certain subgraphs that appear in their system call graphs. These subgraphs can be determined with the help of spectral clustering mechanism present in EigenGCN. With this, the system call graph G will be partitioned into two subgraphs G1 and G2, in which the malicious functionality if any will be present in the subgraph G1. The graph Fourier transform based pooling technique in EigenGCN then computes the features of the subgraphs in the form of graph signals. This graph signals serve as a robust signature to detect malware. The proposed mechanism gave an accuracy of 98.7% on common malware, 97.3% on obfuscated malware, 97.8% on repackaged malware, and 90% on adversarial mimicry malware datasets. As far as we know, this is the first work that proposes a malware detection mechanism, that can detect common as well as obfuscated, repackaged, and mimicry malware in Android.

Machine learning approach to detect android malware using feature-selection based on feature importance score

The hazards posed by malware are proliferating along with technology’s rapid advancement and the use of online services. Specifically, attacks on Android devices are growing enormously because of the boost in the popularity of Smartphones. Existing research confirms that identifying benign or malware applications on the Android platform is possible by analysing the permissions through the machine-learning classifier. There are machine-learning techniques that create models to detect Android malware using permission-based attributes. However, further research is still needed to develop effective feature selection strategies for malware detection mechanisms in Android. In this study, a machine-learning-based Android malware detection mechanism is proposed, and standard machine-learning algorithms are used on multiple permission-based datasets to classify malware. This study suggests a feature selection method that uses the feature importance score computed using Gradient boosting to identify the essential permissions. The proposed methodology decreases the feature vector’s dimension, reducing the model’s training time. We also compare the classifier’s performance with the complete feature set and with the reduced feature set. Examining the results, we notice that the algorithm’s execution time improved significantly for all datasets with negligible loss in accuracy.

FAGnet: Family-aware-based android malware analysis using graph neural network

Android malware family analysis is essential for building an efficient malware detection mechanism. In recent years, many graph representation learning-based malware detection and classification studies have been proposed, and many methods model malware as graph data to mine the behavioral semantics of malware. However, they do not consider the relationship at the sample (graph) level, and malware belonging to the same family has similar malicious behavior. The transformation of samples according to the Data Processing Inequality (DPI) will lead to the loss of mutual information transmission, which inspired us to consider the analysis of malware based on graph representation learning from this perspective. In this paper, we consider introducing the relationship between malware samples, inserting a family representation refinement component that is conducive to improving the family separability in the graph classification task, and propose a Family-Aware Graph neural network Android malware analysis (FAGnet). We use 4 backbones to perform extension experiments on 2 benchmark datasets and comprehensively compare some baseline methods. The experiments verify the effectiveness of FAGnet, which achieves 98.11 % accuracy on the Drebin dataset and 83.45 % and 72.76 % accuracy on the CICAndMal2017 category and family classification, respectively. In addition, FAGnet is evaluated with real-world data, and its satisfactory performance was maintained in real-world scenarios.

AIS for Malware Detection in a Realistic IoT System: Challenges and Opportunities

With the expansion of the digital world, the number of Internet of things (IoT) devices is evolving dramatically. IoT devices have limited computational power and a small memory. Consequently, existing and complex security methods are not suitable to detect unknown malware attacks in IoT networks. This has become a major concern in the advent of increasingly unpredictable and innovative cyberattacks. In this context, artificial immune systems (AISs) have emerged as an effective malware detection mechanism with low requirements for computation and memory. In this research, we first validate the malware detection results of a recent AIS solution using multiple datasets with different types of malware attacks. Next, we examine the potential gains and limitations of promising AIS solutions under realistic implementation scenarios. We design a realistic IoT framework mimicking real-life IoT system architectures. The objective is to evaluate the AIS solutions’ performance with regard to the system constraints. We demonstrate that AIS solutions succeed in detecting unknown malware in the most challenging conditions. Furthermore, the systemic results with different system architectures reveal the AIS solutions’ ability to transfer learning between IoT devices. Transfer learning is a pivotal feature in the presence of highly constrained devices in the network. More importantly, this work highlights that previously published AIS performance results, which were obtained in a simulation environment, cannot be taken at face value. In reality, AIS’s malware detection accuracy for IoT systems is 91% in the most restricted designed system compared to the 99% accuracy rate reported in the simulation experiment.

Malware Mitigation Through Detection UsingSupport Vector Machine and Random Forest Algorithm

Due to the ever-growing threat of malware application, diverse malware detection mechanism has been developed byresearchers. Malware detection relates to the procedure of finding malware on a host device or determining whether a particular program ismalicious or benign. An instance of a malware detection mechanism is an anti-malware program designed to automatically identify malicious programs from the benign program to prevent damage to the host system.The methodologyusedincorporatedcutting-edge detection techniques to providean effective solution to the problem of malicious programs. This study applied a support vector machine and random forest algorithm on malware detection using a dataset obtained from the Kaggle machine learning repository webpage.In an approach to provide a feasible solution, this study structured three methodical approaches that encompass data filtering techniques referred to as preprocessing and the utilization of the correlation metric to select the most relevant features in the first phase. The second approach involves the application of the filtered and selected dataset attributes and tuples to the adapted machine learning models in particular the random forest algorithm and the support vector machine. The final phase as an approach covers the evaluation of the derived model performance using metrics such as precision, accuracy score,and, f1_score. From the statistical result from the two models concerningthe evaluation metrics also, it can be deduced that the random forest classifier performs more effectively in the detection of malicious malware from the dataset sourced from the Kaggle machine learning repository.

Low Resource and Power Consumption and Improved Classification Accuracy for IoT Implementation of a Malware Detection Mechanism using Processor Information

Low Resource and Power Consumption and Improved Classification Accuracy for IoT Implementation of a Malware Detection Mechanism using Processor Information

A Multifaceted Deep Generative Adversarial Networks Model for Mobile Malware Detection

Malware’s structural transformation to withstand the detection frameworks encourages hackers to steal the public’s confidential content. Researchers are developing a protective shield against the intrusion of malicious malware in mobile devices. The deep learning-based android malware detection frameworks have ensured public safety; however, their dependency on diverse training samples has constrained their utilization. The handcrafted malware detection mechanisms have achieved remarkable performance, but their computational overheads are a major hurdle in their utilization. In this work, Multifaceted Deep Generative Adversarial Networks Model (MDGAN) has been developed to detect malware in mobile devices. The hybrid GoogleNet and LSTM features of the grayscale and API sequence have been processed in a pixel-by-pixel pattern through conditional GAN for the robust representation of APK files. The generator produces syntactic malicious features for differentiation in the discriminator network. Experimental validation on the combined AndroZoo and Drebin database has shown 96.2% classification accuracy and a 94.7% F-score, which remain superior to the recently reported frameworks.

Memory Offloading for Remote Attestation of Multi-Service IoT Devices.

Remote attestation (RA) is an effective malware detection mechanism that allows a trusted entity (Verifier) to detect a potentially compromised remote device (Prover). The recent research works are proposing advanced Control-Flow Attestation (CFA) protocols that are able to trace the Prover’s execution flow to detect runtime attacks. Nevertheless, several memory regions remain unattested, leaving the Prover vulnerable to data memory and mobile adversaries. Multi-service devices, whose integrity is also dependent on the integrity of any attached external peripheral devices, are particularly vulnerable to such attacks. This paper extends the state-of-the-art RA schemes by presenting ERAMO, a protocol that attests larger memory regions by adopting the memory offloading approach. We validate and evaluate ERAMO with a hardware proof-of-concept implementation using a TrustZone-capable LPC55S69 running two sensor nodes. We enhance the protocol by providing extensive memory analysis insights for multi-service devices, demonstrating that it is possible to analyze and attest the memory of the attached peripherals. Experiments confirm the feasibility and effectiveness of ERAMO in attesting dynamic memory regions.

IoT-oriented high-efficient anti-malware hardware focusing on time series metadata extractable from inside a processor core

We aim to improve the efficiency of our previously proposed anti-malware hardware; it is a hardware-implemented malware detection mechanism that uses information inside the processor. We previously evaluated a prototype, but, due to its prototypical nature, there remain limitations, such as only detecting certain behaviors, high power consumption, and a tendency to bloat the training model. In this paper, we propose a circuit and a learning method to achieve high efficiency, low power consumption, and light weight for the model. In considering these three issues, we focus on time-series metadata obtained by transforming the processor information. To improve efficiency, we implement predictive detection to predict the behavior of metadata in the malware detection component. This lets the model detect malware within less than 19% of the number of execution cycles of the conventional method. To reduce power consumption, we implement a sampling circuit that interrupts the input to the detection circuit at regular intervals, reducing the system’s uptime by 99% while maintaining judgment accuracy. Finally, for a light weight, we focus on the training process of the metadata generator based on a machine-learning model. By applying sampling learning and feature dimensionality reduction in the training process, a metadata generator approximately 16% smaller than the previous version is created.

Sequential opcode embedding-based malware detection method

In recent years, researchers have focused on uncovering the distinctive malicious patterns of malware samples through opcode sequences using some feature learning methods to improve the accuracy of malware detection mechanisms. However, opcode sequences are often very long. Thus, the feature learning process is to be time-consuming when using the entire sequence or could be ineffective when only a partial part of the sequence is used. In this work, we propose a new malware detection approach, called Sequential Opcode Embedding-based Malware Detection (SOEMD), which aims at capturing common malicious patterns in sequential opcodes. To avoid dealing with the long opcode sequences, SOEMD uses Random walk approach with edge and node selection processes. The proposed method constructs a new vector space that consists of low-dimensional sequential opcode embeddings using an embedding method. Experimental results demonstrate that SOEMD outperforms the baseline methods and provides 100% malware detection.

Evaluation of implementability in a malware detection mechanism using processor information

Currently, software implementation is the mainstream approach for anti-malware measures. However, software-based anti-malware measures are difficult to implement in Internet of Things devices with limited hardware resources. To solve this problem, a malware detection mechanism that can be realized with only hardware has been proposed. The hardware mechanism consists of three elements: an access-hit counter, dividers, and a classifier. The classifier is generated by a random forest and uses processor information as feature values. To reduce the hardware scale, a Hit Rate Table (HRTable) is introduced in place of the dividers. We propose methods of reducing the scale of hardware resources and synchronizing the CPU and the malware detection mechanism. This paper implements the proposed mechanism in hardware, simulates it while considering the delay caused by input/output to the HRTable, and evaluates the hardware scale of the proposed mechanism combined with RISC-V on a field-programmable gate array (FPGA).

On-device Resilient Android Malware Detection using Incremental Learning

In most cases, the Android runs in a battery-driven, low-power connected, embedded real-time environment. New malware attacks are reported every day targeting Android embedded devices. This is because the existing Android malware detection engines are not resilient to zero day attacks. The machine learning based malware detection engines must be re-trained with the newly reported malware and benign samples to manage the zero-day attacks. The re-training is very expensive in terms of CPU and memory. Re-training at embedded devices is very challenging because of its hardware, memory, and energy constraints. In these scenarios, a lightweight, resilient and incremental learning based dynamic Android malware detection mechanism is becoming mandatory. Very little evidence is observed in the related literature; most of the existing incremental learning approaches have not demonstrated their experiments in a real device environment and have not worked in bench-marked real device dynamic analysis datasets. In this work, we select the latest KronoDroid Android dynamic hybrid dataset and propose efficient incremental learning based Android malware detection mechanism using the linear incremental algorithm. We have incrementally trained our mechanism in the real device Android environment and proved the consistent performance keeping the resilient aspect. We have evaluated our mechanism and found that we could achieve the highest incremental accuracy of 97.94%, the lowest training time of 0.5 seconds, and lowest detection time of 0.04 seconds with the smallest model size of 456 bytes when experimented within an on-device Android environment. To the best of our knowledge, this is the first work that proves the incremental learning and resilience scenario using a bench-marked Android real-device dynamic dataset keeping the lowest computational complexity and consistent performance.

DroidEnemy: Battling adversarial example attacks for Android malware detection

In recent years, we have witnessed a surge in mobile devices such as smartphones, tablets, smart watches, etc., most of which are based on the Android operating system. However, because these Android-based mobile devices are becoming increasingly popular, they are now the primary target of mobile malware, which could lead to both privacy leakage and property loss. To address the rapidly deteriorating security issues caused by mobile malware, various research efforts have been made to develop novel and effective detection mechanisms to identify and combat them. Nevertheless, in order to avoid being caught by these malware detection mechanisms, malware authors are inclined to initiate adversarial example attacks by tampering with mobile applications. In this paper, several types of adversarial example attacks are investigated and a feasible approach is proposed to fight against them. First, we look at adversarial example attacks on the Android system and prior solutions that have been proposed to address these attacks. Then, we specifically focus on the data poisoning attack and evasion attack models, which may mutate various application features, such as API calls, permissions and the class label, to produce adversarial examples. Then, we propose and design a malware detection approach that is resistant to adversarial examples. To observe and investigate how the malware detection system is influenced by the adversarial example attacks, we conduct experiments on some real Android application datasets which are composed of both malware and benign applications. Experimental results clearly indicate that the performance of Android malware detection is severely degraded when facing adversarial example attacks.

Deep-Hook: A trusted deep learning-based framework for unknown malware detection and classification in Linux cloud environments

Since the beginning of the 21st century, the use of cloud computing has increased rapidly, and it currently plays a significant role among most organizations’ information technology (IT) infrastructure. Virtualization technologies, particularly virtual machines (VMs), are widely used and lie at the core of cloud computing. While different operating systems can run on top of VM instances, in public cloud environments the Linux operating system is used 90% of the time. Because of their prevalence, organizational Linux-based virtual servers have become an attractive target for cyber-attacks, mainly launched by sophisticated malware designed at causing harm, sabotaging operations, obtaining data, or gaining financial profit. This has resulted in the need for an advanced and reliable unknown malware detection mechanism for Linux cloud-based environments. Antivirus software and today’s even more advanced malware detection solutions have limitations in detecting new, unseen, and evasive malware. Moreover, many existing solutions are considered untrusted, as they operate on the inspected machine and can be interfered with, and can even be detected by the malware itself, allowing malware to evade detection and cause damage. In this paper, we propose Deep-Hook, a trusted framework for unknown malware detection in Linux-based cloud environments. Deep-Hook hooks the VM’s volatile memory in a trusted manner and acquires the memory dump to discover malware footprints while the VM operates. The memory dumps are transformed into visual images which are analyzed using a convolutional neural network (CNN) based classifier. The proposed framework has some key advantages, such as its agility, its ability to eliminate the need for features defined by a cyber domain expert, and most importantly, its ability to analyze the entire memory dump and thus to better utilize the existing indication it conceals, thus allowing the induction of a more accurate detection model. Deep-Hook was evaluated on widely used Linux virtual servers; four state-of-the-art CNN architectures; eight image resolutions; and a total of 22,400 volatile memory dumps representing the execution of a broad set of benign and malicious Linux applications. Our experimental evaluation results demonstrate Deep-Hook’s ability to effectively, efficiently, and accurately detect and classify unknown malware (even evasive malware like rootkits), with an AUC and accuracy of up to 99.9%.

MADP-IIME: malware attack detection protocol in IoT-enabled industrial multimedia environment using machine learning approach

Internet of Things (IoT) is one of the fastest-growing technologies. With the deployment of massive and faster mobile networks, almost every daily-use item is connected to the Internet. IoT-enabled industrial multimedia environment is used for the collection and analysis of different types of multimedia data (i.e., images, videos, audios, etc.). This multimedia data is generated by various types of smart devices like drones, robots, smart controller, smart surveillance system which are deployed for the industrial monitoring and control. The multimedia data is generated in the enormous amount which can be considered as the big data. This data is further utilized in various types of business needs for example, chances of fire accidents in the industrial plant, overall machine health, etc., which can be predicted through the application of big data analytics. Therefore, IoT-enabled industrial multimedia environment is very helpful to the concerned authorities as they come to know the important information in advance. However, all the smart devices are connected and controlled through the Internet. It further causes severe threats to the communication happens in an IoT-enabled industrial multimedia environment. It is vulnerable to various types of attacks such as replay, man-in-the-middle, impersonation, secret information leakage, sensitive information modification, and malware injection (i.e., mirai). Therefore, it is important to prevent the communication of such an environment against the different types of possible attacks. These days, the attacks performed by botnets (i.e., malware attacks such as mirai and reaper) have drawn attention to the researchers. Under the influence of such attacks, the communication of IoT-enabled industrial multimedia environment is disrupted. Moreover, the attackers may also control the smart devices remotely and can change their functionalities. Hence, we need some robust mechanism to detect the presence of the malware attacks in such an environment. In this paper, we propose a malware detection mechanism in IoT-enabled industrial multimedia environment with the help of machine-learning approach, which is named as MADP-IIME. MADP-IIME uses four different types of machine learning methods (i.e., naive bayes, logistic regression, artificial neural networks (ANN) and random forest) to detect the presence of malware attacks successfully. Furthermore, MADP-IIME performs better than other related existing schemes and achieves $$99.5 \%$$ detection and $$0.5 \%$$ false positive rate. In addition, the conducted security analysis proves the resilience of the proposed MADP-IIME against different types of malware attacks.

A Dynamic Robust DL-Based Model for Android Malware Detection

The dramatic increase in Android-based smart devices has brought technological revolution to improve the overall quality of life and thus making it worth a billion-dollar market. Despite the huge hype surrounding Android market, the prevalent and potentially sophisticated malicious mobile malware has become a serious threat to the popular Android platform and an ideal target for varied cyber adversaries. Conversely, multivector malware efficient and timely detection is extremely challenging because it usually hides itself under legitimate third party software’s and having the capability to be easily crafted on any executable file extension. To better streamline this complex issue of paramount concern, the authors propose a highly proficient hybrid deep learning (DL)-enabled intelligent multi-vector malware detection mechanism. The devised approach leverages Convolutional Neural Networks and Bidirectional Long Short-Term Memory (BiLSTM) to efficiently identify persistent malware. The proposed technique has been thoroughly evaluated with publicly available datasets, standard performance metrics, and state-of-the-art hybrid DL-driven architectures and benchmark DL algorithms. Besides, the proposed framework has been cross-validated and shows out performance both in terms of time efficiency and detection accuracy.

GSDroid: Graph Signal Based Compact Feature Representation for Android Malware Detection

Android malwares have evolved in sophistications and intelligence to become more and more evasive to existing detection systems especially those that are signature-based. Machine learning techniques have risen to become a better choice for detecting emerging sophisticated and intelligent Android malwares because of their high prediction accuracies in unseen data. The performance of a machine learning classifier highly depends on the optimal feature representation of the data points. The main behavior of an Android application usually gets reflected in its generated system call sequence. Therefore, system call analysis mechanisms are considered to be more effective for malware detection. The existing feature representations for system call based malware detection mechanisms have high dimensionality and lack the system call dependency relations. Curse of dimensionality (high dimensionality of feature vectors) is a problem in which the higher number of feature components in a feature vector will result in high sparsity in the data. This high sparsity in data can unnecessarily increase the storage space and processing time of the classifier. In order to overcome these limitations, in this paper, we propose a novel graph signal based low dimensional feature representation and extraction mechanism to detect Android malware applications. These low dimensional features are then incorporated as part of a machine learning based intelligent expert system that can automate the malware detection task. In our experimental evaluations, we found that a feature vector of dimension 16 was enough for malware classification when used with random forest and decision tree classifiers. We obtained a maximum accuracy of 0.99 with a feature vector of dimension 16 corresponding to the signal values of 16 prominent system calls when random forest classifier was applied.

A TAN based hybrid model for android malware detection

Android devices are very popular because of their availability at reasonable prices. However, there is a rapid rise of malware applications in Android platform in the recent past years due to its security vulnerabilities. The existing static malware detection mechanisms can locate malicious components associated with the source code of an application and dynamic analysis can identify exploits in the runtime environment. Hence, the advantages of both static and dynamic mechanisms need to be combined to form a hybrid analysis mechanism for achieving better accuracy in malware detection. The existing machine learning based hybrid malware analysis mechanisms do not check the interdependency of static and dynamic features used in their machine learning classifiers. This interdependency can lead to multicollinearity problem which can affect the classifier’s performance. Hence, in this paper we propose a novel TAN (Tree Augmented naive Bayes) based hybrid malware detection mechanism by employing the conditional dependencies among relevant static and dynamic features (API calls, permissions and system calls) which are required for the functionality of an application. We trained three ridge regularized logistic regression classifiers corresponding to API calls, permission and system calls of an application and modeled their output relationships as a TAN (Tree Augmented naive Bayes) for identifying whether the application is malicious or not. The experimental results show that the proposed mechanism can detect malicious applications over a long period with an accuracy of 0.97.

On Existence of Common Malicious System Call Codes in Android Malware Families

Most of the existing Android malware detection mechanisms are based on machine learning algorithms. The problem with the machine learning approaches is the difficulty in finding the best features that uniquely characterize the malwares. Hence, in this article we explore the property that uniquely characterizes Android malware applications. Toward this, we model the system call sequence generated by a malware application as a stationary first-order ergodic Markov chain and prove the existence of typical patterns which contains the malicious system call code of the application. In our implementation, we find the occurrence of common malicious system call codes in the system call sequence of several malware families. Finally a malware detection mechanism is proposed based on the occurrence of malicious system call code s in the system call sequence of an application. We obtain a consistent accuracy of around 0.95 in balanced, slightly unbalanced, and highly unbalanced data sets. In the balanced and slightly unbalanced data sets we obtain greater precision than 0.90; whereas in the highly unbalanced data sets the precision obtained are slightly lower at 0.72.