Malware Detection Research Articles

NGMD: next generation malware detection in federated server with deep neural network model for autonomous networks

Distributed denial-of-service (DDoS) attacks persistently proliferate, impacting individuals and Internet Service Providers (ISPs). Deep learning (DL) models are paving the way to address these challenges and the dynamic nature of potential threats. Traditional detection systems, relying on signature-based techniques, are susceptible to next-generation malware. Integrating DL approaches in cloud-edge/federated servers enhances the resilience of these systems. In the Internet of Things (IoT) and autonomous networks, DL, particularly federated learning, has gained prominence for attack detection. Unlike conventional models (centralized and localized DL), federated learning does not require access to users’ private data for attack detection. This approach is gaining much interest in academia and industry due to its deployment on local and global cloud-edge models. Recent advancements in DL enable training a quality cloud-edge model across various users (collaborators) without exchanging personal information. Federated learning, emphasizing privacy preservation at the cloud-edge terminal, holds significant potential for facilitating privacy-aware learning among collaborators. This paper addresses: (1) The deployment of an optimized deep neural network for network traffic classification. (2) The coordination of federated server model parameters with training across devices in IoT domains. A federated flowchart is proposed for training and aggregating local model updates. (3) The generation of a global model at the cloud-edge terminal after multiple rounds between domains and servers. (4) Experimental validation on the BoT-IoT dataset demonstrates that the federated learning model can reliably detect attacks with efficient classification, privacy, and confidentiality. Additionally, it requires minimal memory space for storing training data, resulting in minimal network delay. Consequently, the proposed framework outperforms both centralized and localized DL models, achieving superior performance.

Evaluating Realistic Adversarial Attacks against Machine Learning Models for Windows PE Malware Detection

During the last decade, the cybersecurity literature has conferred a high-level role to machine learning as a powerful security paradigm to recognise malicious software in modern anti-malware systems. However, a non-negligible limitation of machine learning methods used to train decision models is that adversarial attacks can easily fool them. Adversarial attacks are attack samples produced by carefully manipulating the samples at the test time to violate the model integrity by causing detection mistakes. In this paper, we analyse the performance of five realistic target-based adversarial attacks, namely Extend, Full DOS, Shift, FGSM padding + slack and GAMMA, against two machine learning models, namely MalConv and LGBM, learned to recognise Windows Portable Executable (PE) malware files. Specifically, MalConv is a Convolutional Neural Network (CNN) model learned from the raw bytes of Windows PE files. LGBM is a Gradient-Boosted Decision Tree model that is learned from features extracted through the static analysis of Windows PE files. Notably, the attack methods and machine learning models considered in this study are state-of-the-art methods broadly used in the machine learning literature for Windows PE malware detection tasks. In addition, we explore the effect of accounting for adversarial attacks on securing machine learning models through the adversarial training strategy. Therefore, the main contributions of this article are as follows: (1) We extend existing machine learning studies that commonly consider small datasets to explore the evasion ability of state-of-the-art Windows PE attack methods by increasing the size of the evaluation dataset. (2) To the best of our knowledge, we are the first to carry out an exploratory study to explain how the considered adversarial attack methods change Windows PE malware to fool an effective decision model. (3) We explore the performance of the adversarial training strategy as a means to secure effective decision models against adversarial Windows PE malware files generated with the considered attack methods. Hence, the study explains how GAMMA can actually be considered the most effective evasion method for the performed comparative analysis. On the other hand, the study shows that the adversarial training strategy can actually help in recognising adversarial PE malware generated with GAMMA by also explaining how it changes model decisions.

PermDroid a framework developed using proposed feature selection approach and machine learning techniques for Android malware detection

The challenge of developing an Android malware detection framework that can identify malware in real-world apps is difficult for academicians and researchers. The vulnerability lies in the permission model of Android. Therefore, it has attracted the attention of various researchers to develop an Android malware detection model using permission or a set of permissions. Academicians and researchers have used all extracted features in previous studies, resulting in overburdening while creating malware detection models. But, the effectiveness of the machine learning model depends on the relevant features, which help in reducing the value of misclassification errors and have excellent discriminative power. A feature selection framework is proposed in this research paper that helps in selecting the relevant features. In the first stage of the proposed framework, t-test, and univariate logistic regression are implemented on our collected feature data set to classify their capacity for detecting malware. Multivariate linear regression stepwise forward selection and correlation analysis are implemented in the second stage to evaluate the correctness of the features selected in the first stage. Furthermore, the resulting features are used as input in the development of malware detection models using three ensemble methods and a neural network with six different machine-learning algorithms. The developed models’ performance is compared using two performance parameters: F-measure and Accuracy. The experiment is performed by using half a million different Android apps. The empirical findings reveal that malware detection model developed using features selected by implementing proposed feature selection framework achieved higher detection rate as compared to the model developed using all extracted features data set. Further, when compared to previously developed frameworks or methodologies, the experimental results indicates that model developed in this study achieved an accuracy of 98.8%.

TL‐GNN: Android Malware Detection Using Transfer Learning

ABSTRACTMalware growth has accelerated due to the widespread use of Android applications. Android smartphone attacks have increased due to the widespread use of these devices. While deep learning models offer high efficiency and accuracy, training them on large and complex datasets is computationally expensive. Hence, a method that effectively detects new malware variants at a low computational cost is required. A transfer learning method to detect Android malware is proposed in this research. Because of transferring known features from a source model that has been trained to a target model, the transfer learning approach reduces the need for new training data and minimizes the need for huge amounts of computational power. We performed many experiments on 1.2 million Android application samples for performance evaluation. In addition, we evaluated how well our framework performed in comparison with traditional deep learning and standard machine learning models. In comparison with state‐of‐the‐art Android malware detection methods, the proposed framework offers improved classification accuracy of 98.87%, a precision of 99.55%, recall of 97.30%, F1‐measure of 99.42%, and a quicker detection rate of 5.14 ms using the transfer learning strategy.

Generative Adversarial Networks for Malware Detection in Cloud Computing Environments

In recent years, the proliferation of sophisticated malware threats has necessitated the development of advanced detection techniques to safeguard computer systems and networks. Generative Adversarial Networks (GANs), a class of deep learning models comprising a generator and a discriminator trained in an adversarial manner, have emerged as a promising tool for improving malware detection capabilities. Traditional signature-based malware detection struggles to keep pace with the ever-evolving threat landscape in cloud computing environments. This paper proposes a novel approach utilizing Generative Adversarial Networks (GANs) for enhanced malware detection. The GAN architecture generates realistic malware samples, refining the discriminator's ability to differentiate between legitimate and malicious software. This fosters a model adept at identifying zero-day attacks and unseen malware variants. Evaluation in a cloud environment assesses detection accuracy, efficiency, and generalizability. Findings underscore GANs' potential to enhance cloud-based malware detection, securing the future of cloud computing.

A Hybrid Optimization Model for Efficient Detection and Classification of Malware in the Internet of Things

The proliferation of Internet of Things (IoT) devices and their integration into critical infrastructure and business operations has rendered them susceptible to malware and cyber-attacks. Such malware presents a threat to the availability and reliability of IoT devices, and a failure to address it can have far-reaching impacts. Due to the limited resources of IoT devices, traditional rule-based detection systems are often ineffective against sophisticated attackers. This paper addressed these issues by designing a new framework that uses a machine learning (ML) algorithm for the detection of malware. Additionally, it also employed sequential detection architecture and evaluated eight malware datasets. The design framework is lightweight and effective in data processing and feature selection algorithms. Moreover, this work proposed a classification model that utilizes one support vector machine (SVM) algorithm and is individually tuned with three different optimization algorithms. The employed optimization algorithms are Nuclear Reactor Optimization (NRO), Artificial Rabbits Optimization (ARO), and Particle Swarm Optimization (PSO). These algorithms are used to explore a diverse search space and ensure robustness in optimizing the SVM for malware detection. After extensive simulations, our proposed framework achieved the desired accuracy among eleven existing ML algorithms and three proposed ensemblers (i.e., NRO_SVM, ARO_SVM, and PSO_SVM). Among all algorithms, NRO_SVM outperforms the others with an accuracy rate of 97.8%, an F1 score of 97%, and a recall of 99%, and has fewer false positives and false negatives. In addition, our model successfully identified and prevented malware-induced attacks with a high probability of recognizing new evolving threats.

Malware Detection using Machine Learning

As the level of malware and viruses is on the rise, the prominence of effective detection systems is crucial. Malwares are the modern-day threats that have troubled major companies worldwide. This article explores in depth two powerful machine learning tools, Random Forest, Support Vector Machines in particular, for the detection of malware. Our study revealed the Random Forest's capacity to reach the upper detection accuracy limit of 98% by applying an analysis of a dataset of variousmalware samples. The feature selection process as well as the model improvement that we've adopted have substantially improved use of our approach for malware detection, and this is thereby highly crucial for organizations to fight against evolving cyber threats. The results of the present research support the ongoing actionsof strengthening cybersecurity security, therefore, providing invaluable information for proactive defense approach mechanisms against malicious software attacks.

Estimating Malware Impact on Network Traffic Analysis by Using Wireshark

With the increasing prevalence of advanced cyber threats, there is a growing need for effective cybersecurity measures that can detect and visualize malware attacks. This research introduces an integrated approach that combines malware detection techniques with geospatial visualization methods to enhance the identification and analysis of cyber-attacks. By analyzing packets in the HTTP protocol, we identify suspicious file transfers and compute their hash values for further examination. To assess the threat level of these transferred files, we utilize the Virus Total platform to conduct comprehensive scans for malware. At the same time, by utilizing geolocation data, we map out both the origins and destinations of these attacks, providing valuable spatial context for understanding global patterns in cyber threats. In addition to enabling the identification of potentially harmful files, the proposed approach also provides a comprehensive visualization of how these threats are spread geographically. Our findings contribute to advancing cybersecurity strategies by facilitating proactive threat mitigation and enhancing incident response capabilities. The integration of malware detection, hash analysis, and geospatial visualization emphasizes the importance of adopting a multidimensional approach in strengthening network security infrastructure.

CarePlus: A general framework for hardware performance counter based malware detection under system resource competition

Hardware performance counter (HPC) has been used for malware detection because of its lightweight overhead. Unfortunately, such detection models including their software implementation and hardware implementation suffer from performance decline in environments where resource competition among programs exists in the operating system. In this paper, we propose a framework called CarePlus, which enables two kinds of implementations of hardware performance counter-based malware detection (HMD) resilient to resource competition. The core idea is to detect malware by using invariants extracted from HPC-level behaviors in resource competition environments. To achieve this, a benchmark-based resource pressure generator is designed to generate controlled resource competition environments for observing typical HPC-level behavior of a program. Then, a behavior representation network is trained to map HPC-level behaviors in any competition environment into low-dimensional representations, which allows software-implemented HMD models built on them to detect malware regardless of resource competition. Finally, an adapter is introduced to project behavior representation in the competition environment into data that conforms to the training distribution of the hardware-implemented HMD model. Using three datasets collected in different application systems (e.g., server or desktop) with different resource competition types or levels, the experimental results show that compared with existing detection models, CarePlus is helpful to improve the performance of software-implemented HMD classifier and hardware-implemented HMD classifier in the competition environment. We also prove that the classifier using CarePlus is insensitive to different application systems. Finally, we demonstrate the computational overhead.

Experimental Validation of a Command and Control Traffic Detection Model

Network intrusion detection systems (NIDS) are commonly used to detect malware communications, including command-and-control (C2) traffic from botnets. NIDS performance assessments have been studied for decades, but mathematical modeling has rarely been used to explore NIDS performance. This paper details a mathematical model that describes a NIDS performing packet inspection and its detection of malware's C2 traffic. The paper further describes an emulation testbed and a set of cyber experiments that used the testbed to validate the model. These experiments included a commonly used NIDS (Snort) and traffic with contents from a pervasive malware (Emotet). Results are presented for two scenarios: a nominal scenario and a “stressed” scenario in which the NIDS cannot process all incoming packets. Model and experiment results match well, with model estimates mostly falling within 95 <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\%$</tex-math></inline-formula> confidence intervals on the experiment means. Model results were produced 70-3000 times faster than the experimental results. Consequently, the model's predictive capability could potentially be used to support decisions about NIDS configuration and effectiveness that require high confidence results, quantification of uncertainty, and exploration of large parameter spaces. Furthermore, the experiments provide an example for how emulation testbeds can be used to validate cyber models that include stochastic variability.

РОЗРОБКА ПІДХОДУ ДО ВИЯВЛЕННЯ ШКІДЛИВОГО ПЗ ДЛЯ ANDROID З ВИКОРИСТАННЯМ МЕТОДІВ ГЛИБИННОГО НАВЧАННЯ

РОЗРОБКА ПІДХОДУ ДО ВИЯВЛЕННЯ ШКІДЛИВОГО ПЗ ДЛЯ ANDROID З ВИКОРИСТАННЯМ МЕТОДІВ ГЛИБИННОГО НАВЧАННЯ

CMD: Co-Analyzed IoT Malware Detection and Forensics via Network and Hardware Domains

CMD: Co-Analyzed IoT Malware Detection and Forensics via Network and Hardware Domains

PellucidAttachment: Protecting Users From Attacks via E-Mail Attachments

Malicious email attachments are a common and successful attack vector on today's Internet. Sophisticated at- tackers can craft highly-targeted attachments, using publicly available information about potential victims to create convincing documents that contain hidden malicious payloads. Users who open these attachments using vulnerable applications are at a high risk of infection. Unfortunately, current mitigations are unreliable, relying either on fallible malware detection techniques or user education. In this work, we propose adopting a default policy of isolated attachment rendering. Emails bearing attachments are transpar- ently rewritten (in a sandboxed virtual machine environment) to contain static renderings of the attachments. Users who wish to obtain the original attachment are explicitly warned of the dan- gers of doing so – akin to TLS warnings as used in web browsers before being allowed to access the requested documents. We implement this technique in a system we call PellucidAttachment. We further report on an extensive user study that measures the usability and effectiveness of PellucidAttachment in shielding users from attacks. Our evaluation shows that adopting email attachment security indicators and an isolation-by-default policy results in a significant increase in user security, while maintaining the usability of email attachments.

Robust Intelligent Malware Detection Using Deep Learning

Abstract: In the modern era of technology, malicious software, or malware, holds a serious security hazard as computer users, businesses, and governments see an uptick in malware attacks. In attempts to identify unknown malware, current malware detection solutions use dynamic as well as static examination of malware signatures and behavior patterns, which takes time and is unsuccessful. Modern malware employs evasive strategies such as metamorphosis and polymorphism to rapidly alter its actions and produce a multitude of variants. Machine learning algorithms (MLAs) are being used more and more to do an efficient malware analysis because new malware is primarily versions of current malware. Extensive feature engineering, feature learning, and feature representation are needed for this. It is likely to fully eliminate the feature engineering stage by utilizing sophisticated MLAs like deep learning. Even though there have been a few fresh investigations in the field, the algorithms' performance is skewed by the training set. It is a prerequisite to reduce bias and figure out these techniques holistically in order to develop new, improved techniques for successful zero-day malware detection. This paper fills a vacuum in the literature by comparing and contrasting deep learning architectures with standard MLAs for malware detection, classification, and categorization using public and private datasets. The public and private dataset’s train and test splits, which were gathered during distinctly different periods, are not connected to one another in the experimental study. Furthermore, we provide a new method of image processing with ideal parameters for deep learning architectures and MLAs. In response to a thorough scientific assessment of these methodologies, deep learning architectures perform more efficiently than traditional MLAs. All in all, our work suggests a scalable and multimodal deep learning system for real-time malware detection through visual means. An improved technique for successful zero-day malware detection is the visualization and deep learning architectures for static, dynamic, and image processing based blended methods in a big data environment.

Classification of Malware Images Using Fine-Tunned ViT

Malware detection and classification have become critical tasks in ensuring the security and integrity of computer systems and networks. Traditional methods of malware analysis often rely on signature-based approaches, which struggle to cope with the ever-evolving landscape of malware variants. In recent years, deep learning techniques have shown promising results in automating the process of malware classification. This paper presents a novel approach to malware image classification using the Vision Transformer (ViT) architecture. In this work, we adapt the ViT model to the domain of malware analysis by representing malware images as input tokens to the ViT architecture. To evaluate the effectiveness of the proposed approach, we used a comprehensive dataset comprising 14,226 malware samples across 26 families. We compare the performance of our ViT-based classifier with traditional machine learning methods and other deep learning architectures. Our experimental results showcase the potential of the ViT in handling malware images, achieving a classification accuracy of 98.80%. The presented approach establishes a strong foundation for further research in utilizing state-of-the-art deep learning architectures for enhanced malware analysis and detection techniques.

Multi-variants vision transformer-based malware image classification model using multi-criteria decision-making

Visualization-based malware detection gets more and more attention for detecting sophisticated malware that traditional antivirus software may miss. The approach involves creating a visual representation of the memory or portable executable files (PEs). However, most current visualization-based malware classification models focus on convolution neural networks instead of Vision transformers (ViT) even though ViT has a higher performance and captures the spatial representation of malware. Therefore, more research should be performed on malware classification using vision transformers. This paper proposes a multi-variants vision transformer-based malware image classification model using multi-criteria decision-making. The proposed method employs Multi-variants transformer encoders to show different visual representation embeddings sets of one malware image. The proposed architecture contains five steps: (1) patch extraction and embeddings, (2) positional encoding, (3) multi-variants transformer encoders, (4) classification, and (5) decision-making. The variants of transformer encoders are transfer learning-based models i.e., it was originally trained on ImageNet dataset. Moreover, the proposed malware classifier employs MEREC-VIKOR, a hybrid standard evaluation approach, which combines multi-inconsistent performance metrics. The performance of the transformer encoder variants is assessed both on individual malware families and across the entire set of malware families within two datasets i.e., MalImg and Microsoft BIG datasets achieving overall accuracy 97.64 and 98.92 respectively. Although the proposed method achieves high performance, the metrics exhibit inconsistency across some malware families. The results of standard evaluation metrics i.e., Q, R, and U show that TE3 outperform the TE1, TE2, and TE4 variants achieving minimal values equal to 0. Finally, the proposed architecture demonstrates a comparable performance to the state-of-the-art that use CNNs.

Malware Analysis Using Transfer Learning

Abstract: The evolution of malware threats demands continuous innovation in detection techniques to safeguard systems. This research project introduces a comprehensive solution aimed at unveiling malware detection capabilities through the integration of cutting-edge methodologies and APIs. At its core, our tool utilises transfer learning techniques to analyse files for potential malicious content, providing a first line of defence against emerging threats. Building upon this foundation, the integration of the Virustotal API enhances enumeration capabilities, utilising the collective intelligence of numerous antivirus engines to validate and quantify detected threats. Then it calculates a malware score based on this enumeration, So everyone can easily understand how malicious that file is.

KFFPDet: Android malicious application detection system with assisted detection of adversarial samples

Machine learning methods are widely used in Android malware detection, but carefully scrambled adversarial samples can effectively evade detection. Adversarial defence methods such as retraining and ensemble learning have high training costs and significant errors. This paper proposes a novel Android malware detection system, KFFPDet, to detect adversarial samples. It can detect adversarial samples efficiently. Firstly, this paper uses K-Nearest Neighbor (KNN) as the primary detection algorithm. In addition, this paper proposes a three-stage adversarial sample detection method, which saves the detection cost and reduces the error through prior knowledge. In the first stage, the frequency difference between benign typical features and malicious typical features is used to filter adversarial samples. In the second stage, the feature continuous values of benign typical features are used for adversarial sample filtering. The third stage filters adversarial samples by detecting isolation permissions and application programming interface (API). Experiments on various benchmark datasets verify the detection effect of KFFPDet. KFFPDet achieves 96% accuracy of adversarial sample detection on the VirusShare dataset. Compared with other advanced methods, KFFPDet ’s adversarial sample detection accuracy is improved by 4.43% to 94.53%. The experimental results show that the proposed three-stage adversarial sample detection method is useful and will help design a more effective adversarial sample detection scheme.

Design and Development of Android App Malware Detector API Using Androguard and Catboost

Abstract: Android has been constant target of attacks through the use of malicious applications (malware) that can harm users, for instance, by leaking sensitive data (e.g., bank account details), blocking access to information and demanding monetary compensation for the ransom, or even leveraging social engineering scams. A large number of malicious applications is distributed in a daily basis through different distribution vectors, such as application markets, including official and third party stores, or untrusted sources like Web repositories. The increasing prevalence of Android malware necessitates advanced detection mechanisms to safeguard users and their devices. The aim of the project is to presents an innovative approach to Android malware detection, integrating machine learning, blockchain technology, and web development tools. The proposed system is to develop a Andriod App Malware Detector API capable of identifying and mitigating malicious applications effectively. The system begins with the collection of diverse datasets comprising both benign and malicious Android applications, ensuring the representation of various threat vectors and scenarios. Androguard, a powerful tool for Android app analysis, the system extracts relevant features such as permissions, API calls, and intents, providing valuable insights into the behaviour and characteristics of each application. The AndroMal Model is designed and trained using CatBoost Algorithm and integrated with a blockchain framework for secure metadata storage. Consensus mechanisms and smart contracts enhance transparency and reliability. Privacy considerations, continuous monitoring, and user feedback mechanisms further fortify the system. The proposed design promises an effective, scalable, and user-centric solution for Android malware detection.

IMPLEMENTATION OF DYNAMIC METHOD FOR MALWARE DETECTION IN EMAIL PHISHING ATTACKS ON LET'S DEFEND

In the rapidly evolving landscape of cybersecurity threats, the need for robust defenses against phishing attacks has become paramount. This study explores the efficacy of malware detection in phishing email attacks using dynamic analysis on the Letsdefend.io platform. Leveraging the insights provided by the Deloitte Center for Controllership regarding the escalating frequency of cyber adversaries targeting organizational data, this research investigates the effectiveness of the Letsdefend.io platform, particularly utilizing the SOC 146 rule, in identifying and mitigating phishing threats. Through a comprehensive analysis process encompassing dynamic malware analysis techniques, such as those employed by VirusTotal and URLHaus, alongside detailed examination of suspicious email attachments using the Mailbox feature, this study aims to provide insights into the evolving tactics of phishing attackers, specifically those utilizing Excel 4.0 Macros. The research methodology involves collecting malware samples for analysis, configuring sandbox environments with tools like Process Monitor and Regshot, and utilizing sophisticated analysis tools like ProcDot to visualize malware behavior. Additionally, the study examines the effectiveness of the Letsdefend.io platform in detecting phishing URLs and malicious domains reported by AnyRun and URLHaus databases. The findings reveal promising results in the detection and identification of phishing threats, shedding light on the potential of dynamic analysis methods in bolstering cybersecurity defenses against evolving phishing techniques. This research contributes to the ongoing efforts to enhance cybersecurity measures and protect organizational assets from the pervasive threat of phishing attacks.