Malware Detection Research Articles

Unmasking the common traits: an ensemble approach for effective malware detection

Unmasking the common traits: an ensemble approach for effective malware detection

Mobile Malware Detection using Machine Learning Classifiers

In today world the mobile malware shows the significant threat to the security and privacy of the society using smartphones. These malware aims to access the sensitive data and harm the devices of users. This paper conducts a comprehensive comparison between the various machine learning and traditional methods for mobile malware detection based on the research papers published by the authors. Signature-based detection depends upon the predefined and common patterns, while the anomaly based techniques analyse the deviation from the regular normal behaviour. This study discusses the strengths and limitations of different approaches and highlights the need for adopting the malware detection methods to fight the growing threats. It also examines the role of machine learning algorithms, like Decision Trees, Random Forests, Convolutional Neural Networks, Support Vector Machines, and Naïve Bayes, for better malware detection. Latest findings and research highlights the importance of the continuing innovation to fight the emerging threat to the user privacy, data and security due to malwares. Keywords: Mobile Malware, Artificial Intelligence, Virus, Signature-based Detection, Machine Learning

An effective attention and residual network for malware detection

AbstractDue to its open source and large user base, Android has emerged as the most popular operating system. Android's popularity and openness have made it a prime target for malicious attackers. Permissions have received great attention from researchers because of their effectiveness in restricting applications’ access to sensitive resources. However, existing malware detection methods based on permissions are easily bypassed by inter‐application resource access. To address these issues, we combine inter‐application resource access‐related intent features with permission features. Besides, we designed a customized convolutional neural network using two squeeze‐and‐excitation blocks to learn the inherent relationships between multi‐type features. The two basic SE blocks perform squeezing operations based on average pooling and max pooling, respectively, to compute channel‐wise attention from multiple perspectives. We designed a series of experiments based on real‐world samples to evaluate the efficacy of the proposed framework. Empirical results demonstrate that our framework outperforms state‐of‐the‐art methods, achieving an accuracy of 96.29%, precision of 97.52%, recall of 94.63%, F1‐score of 96.06% and MCC of 92.60%. These promising experimental results consistently demonstrate that AMERDroid is an effective approach for Android malware detection.

MalDMTP: A Multi-tier Pooling Method for Malware Detection based on Graph Classification

MalDMTP: A Multi-tier Pooling Method for Malware Detection based on Graph Classification

AI-powered malware detection with Differential Privacy for zero trust security in Internet of Things networks

The widespread usage of Android-powered devices in the Internet of Things (IoT) makes them susceptible to evolving cybersecurity threats. Most healthcare devices in IoT networks, such as smart watches, smart thermometers, biosensors, and more, are powered by the Android operating system, where preserving the privacy of user-sensitive data is of utmost importance. Detecting Android malware is thus vital for protecting sensitive information and ensuring the reliability of IoT networks. This article focuses on AI-enabled Android malware detection for improving zero trust security in IoT networks, which requires Android applications to be verified and authenticated before providing access to network resources. The zero trust security model requires strict identity verification for every entity trying to access resources on a private network, regardless of whether they are inside or outside the network perimeter. Our proposed solution, DP-RFECV-FNN, an innovative approach to Android malware detection that employs Differential Privacy (DP) within a Feedforward Neural Network (FNN) designed for IoT networks under the zero trust model. By integrating DP, we ensure the confidentiality of data during the detection process, setting a new standard for privacy in cybersecurity solutions. By combining the strengths of DP and zero trust security with the powerful learning capacity of the FNN, DP-RFECV-FNN demonstrates the ability to identify both known and novel malware types and achieves higher accuracy while maintaining strict privacy controls compared with recent papers. DP-RFECV-FNN achieves an accuracy ranging from 97.78% to 99.21% while utilizing static features and 93.49% to 94.36% for dynamic features of Android applications to detect whether it is malware or benign. These results are achieved under varying privacy budgets, ranging from ϵ=0.1 to ϵ=1.0. Furthermore, our proposed feature selection pipeline enables us to outperform the state-of-the-art by significantly reducing the number of selected features and training time while improving accuracy. To the best of our knowledge, this is the first work to categorize Android malware based on both static and dynamic features through a privacy-preserving neural network model.

A Review of Code Obfuscation and Anti Analysis Techniques

This paper investigates the intricate landscape of code obfuscation and anti analysis techniques within software security. The primary objective is to comprehensively understand the various methods employed to obscure code functionality and impede analysis efforts. Through an extensive literature review, this study examines the fundamental concepts of code obfuscation and identifies common anti analysis strategies utilized by malware authors. By exploring the arms race between obfuscation and analysis, this paper aims to shed light on the evolving tactics employed by both defenders and adversaries in cybersecurity. Methodologically, this research delves into the detailed explanation of prevalent code obfuscation techniques, including control flow obfuscation, data obfuscation, and string obfuscation, alongside examples and case studies illustrating their effectiveness. Similarly, the study scrutinizes anti analysis methods utilized by malware authors, highlighting their impact on software security and malware analysis. Through experimental evaluation and case studies of real world incidents, this research evaluates the efficacy of code obfuscation and anti analysis techniques, providing insights into their implications for software security and malware defence strategies. Key findings of this research underscore the critical role of code obfuscation in software security and the escalating challenge it poses for malware detection and analysis. Moreover, the study elucidates the significance of effectively understanding and countering anti analysis techniques to bolster cybersecurity defences. The implications of this research extend to practitioners and researchers, offering valuable insights into developing mitigation strategies and tools to combat code obfuscated malware and enhance overall software security.

MeMalDet: A memory analysis-based malware detection framework using deep autoencoders and stacked ensemble under temporal evaluations

Malware attacks continue to evolve, making detection challenging for traditional static and dynamic analysis techniques. On the other hand, memory analysis provides valuable behavioral insights, but prior research lacks temporal evaluations which are critical for robust detection of new malware variants over time. This paper presents MeMalDet, a novel memory analysis-based malware detection technique using deep autoencoders and stacked ensemble learning. We introduce an improved dataset with temporal attributes enabling more realistic evaluations of memory-based malware detection techniques under concept drift (temporal data split). MeMalDet extracts optimal features from memory dumps using deep autoencoders in an unsupervised manner, avoiding manual feature engineering. A stacked ensemble of supervised classifiers then performs highly accurate malware detection. Extensive experiments on our improved large-scale public dataset demonstrate MeMalDet’s ability to maintain high performance when detecting obfuscated malware under temporal splits. We achieve up to 98.82% accuracy and 98.72% F1-score in detecting previously unseen advanced obfuscated malware, significantly improving upon state-of-the-art memory analysis-based malware detection techniques. The improved dataset enables temporally robust evaluations, which is a novel contribution. MeMalDet combines the benefits of representation learning and supervised machine learning ensemble classification for effective malware detection over time using memory analysis. This research provides a new capability for identifying evasive modern malware and combating evolving real-world threats.

Bon-APT: Detection, attribution, and explainability of APT malware using temporal segmentation of API calls

Advanced Persistent Threats (APTs) are highly sophisticated cyberattacks that are aimed at achieving strategic goals and are usually backed by a well-funded entity. In this paper, we tackle the challenges of detecting and attributing APTs by proposing Bon-APT, a temporal learning method that analyzes and segment the occurrences of API calls invoked during the dynamic analysis of the examined PE. Those segments can be used to profile the temporal behavior of an APT, provide insights into its modus operandi, and induce an accurate machine-learning based model for the detection and attribution of APTs. Moreover, Bon-APT provides a human comprehensible explainability regarding the relations among segments as well as the behavior of the APT in each of them. This not only improves transparency and reliability from a human expert perspective, but it can also enrich the security experts with new knowledge regarding APTs' behavior. To evaluate Bon-APT, we built a unique collection of 12,655 APTs, belonging to 188 different cyber-groups and 17 different nations, which, to the best of our knowledge, is the largest collection of its kind. We conducted four experiments to evaluate the proposed method and compared its performance to the performance of state-of-the-art methods on the tasks of APT detection and authorship attribution (for both group and nation). Bon-APT achieved promising results in each of the tasks while outperforming the state-of-the-art methods. Bon-APT also provides a simple and concise explanation regarding its decisions and the APT behavior, as well as an easy, straightforward visual and quantitative behavioral comparison.

DFRMIdroid: A Comprehensive Fusion Approach Utilizing Permissions and Intents Analysis with the DFR-MI Algorithm for Enhanced Malware Detection on Android Devices

DFRMIdroid: A Comprehensive Fusion Approach Utilizing Permissions and Intents Analysis with the DFR-MI Algorithm for Enhanced Malware Detection on Android Devices

A Comprehensive Discourse on Shallow Learning and its Applications

Shallow learning, a fundamental approach in machine learning, encompasses a variety of algorithms and techniques aimed at learning patterns and making predictions from labelled data. Unlike deep learning, which involves complex architectures with multiple layers of abstraction, shallow learning focuses on simpler models with limited complexity. This abstract explores the essence of shallow learning, its algorithms, applications, and challenges. Shallow learning algorithms include classic methods such as decision trees, support vector machines, k-nearest neighbours, and logistic regression, among others. These algorithms are typically trained using supervised learning techniques, where the model learns from input-output pairs to make predictions on new, unseen data. Shallow learning models excel in tasks such as classification and regression, where the goal is to assign labels or predict continuous values to input data. Applications of shallow learning span across various domains, including healthcare, finance, marketing, and cyber security. In healthcare, shallow learning models are used for disease diagnosis and prognosis prediction based on patient data. In finance, these models aid in fraud detection, credit scoring, and stock market prediction. Marketing applications involve customer segmentation and churn prediction, while in cyber security; shallow learning is utilized for malware detection and network intrusion detection.

Enhancing reinforcement learning based adversarial malware generation to evade static detection

The anti-detection capabilities of adversarial malware examples have drawn the attention of antivirus vendors and researchers. In black-box scenarios where internal information of the target model cannot be accessed, with the ability of the reinforcement learning (RL) agents to adjust strategies based on the feedback from the environment, existing RL-based methods enable evasion of Windows PE malware detectors. However, obtaining evasion rewards as positive feedback in the black-box setting proves challenging, resulting in low training efficiency. To address this issue, we introduce the intrinsic curiosity reward into the framework to motivate the agent to explore unknown state spaces and learn effective evasion strategies. Additionally, we employ the generative adversarial network (GAN) to obtain varying synthetic data, which replaces random or benign bytes as adversarial payloads for the agent's action content, improving attack capabilities and reducing the risk of hard-coded adversarial perturbations being anchored. We compare the attack performance with other RL-based baseline methods, and experimental results show that our framework is more flexible and effective, achieving a 63%-85% attack success rate against EMBER, FireEye and MalConv. Even if defensive measures are taken, the proposed method still has a certain attack capability, and the success rate remains between 48%-67%.

A hybrid approach for malware detection in SDN‐enabled IoT scenarios

AbstractMalware presents a significant threat to computer systems security, especially in ARM and MIPS architectures, driven by the rise of the internet of things (IoT). This paper introduces Heimdall, a hybrid approach that integrates YARA signatures and machine learning in programmable switches for efficient malware detection in SDN‐enabled IoT environments. The machine learning classifier achieved an accuracy of 99.33% against the IoT‐23 dataset. When evaluated in an emulated environment with real malware samples, Heimdall exhibits a 98.44% detection rate and an average processing time of 0.0217 s.

Malware traffic detection based on type II fuzzy recognition

In recent years, a surge in malicious network incidents and instances of network information theft has taken place, with malware identified as the primary culprit. The primary objective of malware is to disrupt the normal functioning of computers and networks, all the while surreptitiously gathering users’ private and sensitive information. The formidable concealment and latency capabilities of malware pose significant challenges to its detection. In light of the operational characteristics of malware, this paper conducts an initial analysis of prevailing malware detection schemes. Subsequently, it extracts fuzzy features based on the distinct characteristics of malware traffic. The approach then integrates traffic detection techniques with Type II fuzzy recognition theory to effectively monitor malware-related traffic. Finally, the paper classifies the identified malware instances according to fuzzy association rules. Experimental results showcase that the proposed method achieves a detection accuracy exceeding 90%, with a remarkably low false alarm rate of approximately 5%. This method adeptly addresses the challenges associated with malware detection, thereby making a meaningful contribution to enhancing our country’s cybersecurity.

Malware similarity and a new fuzzy hash: Compound Code Block Hash (CCBHash)

In the last few years, malware analysis has become increasingly important due to the rise of sophisticated cyberattacks. One of the objectives of this cybersecurity branch is to find similarities between different files or functions used by malware programmers, thus allowing malware detection, classification and even attribution in a timely manner. In this article we survey the state of the art in this area, reviewing the different techniques that can be applied to the field, with the objective of studying similarity, and therefore detecting, classifying and attributing malware samples. We have developed a fuzzy hash capable of characterizing malware by generating an easily comparable and storable signature of its functions. Since our goal is to detect these similarities in huge amounts of data within a reasonable time-frame, the size of the hash must be limited while retaining as much information as possible.

Enhanced Profile Hidden Markov Model for Metamorphic Malware Detection

Metamorphic malware poses a significant threat to conventional signature-based malware detection since its signature is mutable. Multiple copies can be created from metamorphic malware. As such, signature- based malware detection is impractical and ineffective. Thus, research in recent years has focused on applying machine learning-based approaches to malware detection. Profile Hidden Markov Model is a probabilistic model that uses multiple sequence alignments and a position-based scoring system. An enhanced Profile Hidden Markov Model was constructed with the following modifications: n-gram analysis to determine the best length of n-gram for the dataset, setting frequency threshold to determine which n-gram opcodes will be included in the malware detection, and adding consensus sequences to multiple sequence alignments. 1000 malware executables files and 40 benign executable files were utilized in the study. Results show that n-gram analysis and adding consensus sequence help increase malware detection accuracy. Moreover, setting the frequency threshold based on the average TF-IDF of n-gram opcodes gives the best accuracy in most malware families than just by getting the top 36 most occurring n-grams, as done in previous studies.

Malware Detection Using Machine Learning

In this work, we present a flexible system that makes use of various machine learning methods to efficiently distinguish between malware and clean files while purposefully reducing false positives. In the field of cybersecurity, our strong framework is both flexible and strong, working along with different machine learning algorithms. Our study unfolds with an exploration of basic principles using the Random Model, K Nearest Neighbouring Classifier (KNN), and Logistic Regression as foundational parts, emphasizing the differentiation between malware and benign files. Extensive experiments on mediumsized datasets that include malware and clean files verify the effectiveness of our methodology. The system then goes through a painstaking scaling-up process that guarantees smooth operation with big datasets containing both malware and clean files. Our methodology is validated by analysing three important algorithms: Random Model, KNN, and Logistic Regression, each of which adds unique advantages to the malware detection system. The evaluation, which is carried out on several datasets, aims to minimize false positives while striking a compromise between precision and recall. Finally, our flexible system, implemented and evaluated on many datasets, demonstrates its efficacy in distinguishing malware from clean files. The framework's flexibility and scalability make it an invaluable tool in the everevolving field of cybersecurity, providing a sophisticated method of malware detection. The proposed algorithms emphasize the framework's potential as a supplementary tool to current cybersecurity measures while also adding to its reliability. Keywords— ML, KNN, RM, LR

Android malware detection framework based on sensitive opcodes and deep reinforcement learning

Malware attack is a growing problem on the Android mobile platform due to its popularity and openness. Although numerous malware detection approaches have been proposed, it still remains challenging for malware detection due to a large amount of constantly mutating apps. The opcode, as the most fundamental part of Android app, possesses good resistance against obfuscation and Android version updates. Due to the large number of opcodes, most opcode-based methods employ statistical-based feature selection, which disrupts the correlation and semantic information among opcodes. In this paper, we propose an Android malware detection framework based on sensitive opcodes and deep reinforcement learning. Firstly, we extract sensitive opcode fragments based on sensitive elements and then encode the features using n-gram. Next, we use deep reinforcement learning to select the optimal subset of features. During the process of handling opcodes, we focus on preserving semantic information and the correlation among opcodes. Finally, our experimental results show an accuracy of 0.9670 by using the 25 opcode features we obtained.

GSB: GNGS and SAG-BiGRU network for malware dynamic detection.

With the rapid development of the Internet, the continuous increase of malware and its variants have brought greatly challenges for cyber security. Due to the imbalance of the data distribution, the research on malware detection focuses on the accuracy of the whole data sample, while ignoring the detection rate of the minority categories' malware. In the dataset sample, the normal data samples account for the majority, while the attacks' malware accounts for the minority. However, the minority categories' attacks will bring great losses to countries, enterprises, or individuals. For solving the problem, this study proposed the GNGS algorithm to construct a new balance dataset for the model algorithm to pay more attention to the feature learning of the minority attacks' malware to improve the detection rate of attacks' malware. The traditional malware detection method is highly dependent on professional knowledge and static analysis, so we used the Self-Attention with Gate mechanism (SAG) based on the Transformer to carry out feature extraction between the local and global features and filter irrelevant noise information, then extracted the long-distance dependency temporal sequence features by the BiGRU network, and obtained the classification results through the SoftMax classifier. In the study, we used the Alibaba Cloud dataset for malware multi-classification. Compared the GSB deep learning network model with other current studies, the experimental results showed that the Gaussian noise generation strategy (GNGS) could solve the unbalanced distribution of minority categories' malware and the SAG-BiGRU algorithm obtained the accuracy rate of 88.7% on the eight-classification, which has better performance than other existing algorithms, and the GSB model also has a good effect on the NSL-KDD dataset, which showed the GSB model is effective for other network intrusion detection.

Convnext-Eesnn: An effective deep learning based malware detection in edge based IIOT

A rising number of edge devices, like controllers, sensors, and robots, are crucial for Industrial Internet of Things (IIoT) networks for collecting data for communication, storage, and processing. The security of the IIoT could be compromised by any malicious or unusual behavior on the part of any of these devices. They may also make it possible for malicious software placed on end nodes to enter the network and perform unauthorized activities. Existing anomaly detection techniques are less effective due to the increasing diversity of the network and the complexity of cyberattacks. In addition, most strategies are ineffective for devices with limited resources. Therefore, this work presents an effective deep learning based Malware Detection framework to make the edge based IIoT network more secure. This multi-stage system begins with the Deep Convolutional Generative Adversarial Networks (DCGAN) based data augmentation method to overcome the issue of data imbalance. Next, a ConvNeXt-based method extracts the features from the input data. Finally, an optimized Enhanced Elman Spike Neural Network (EESNN) based deep learning is utilized for malware recognition and classification. Using two distinct datasets— MaleVis and Malimg— the generalizability of the suggested model is clearly demonstrated. With an accuracy of 99.24% for MaleVis and 99.31% for the Malimg dataset, the suggested strategy demonstrated excellent results and surpassed all other existing methods. It illustrates how the suggested strategy outperforms alternative models and offers numerous benefits.

A Framework for Detection of Malicious Code by Exploiting Machine Learning Techniques on Portable Executables

Executable files coming from the internet bring along with them many potential hazards and vul- nerabilities in the form of malware to computer systems. The executables can be of form raw binaries, mnemonics, libraries, and function calls/APIs. They can misguide many of the conventional malware detection techniques. This paper explores the potential of Machine Learning- based methods for malware detection problems. The scope of the work here is currently limited to Static Anal- ysis of Executable files. Various feature selection tech- niques are implemented to reduce the size of the training data. Machine learning algorithms like K-Nearest Neigh- bors and Random Forest Classifier were trained on the curated feature sets. The outperforming experiment re- sult was shown by the Random Forest Classifier having an accuracy of 99.5%. We have developed a framework as a two-step module; in the first step, a list of features are extracted from a given executable file, and then for the next step, trained algorithm is integrated into the framework which will classify whether the given executa- ble file is malicious or not. This framework is demon- strated in the form of a Webapp developed in Python. Furthermore, this framework is evaluated based on its performance on a small dataset containing 35 portable executables (.exe) files and it is observed to be retaining the accuracy of the trained algorithm.