Malware Families Research Articles

A precise method of identifying Android application family

AbstractImplementing the necessary countermeasures to detect the growing and highly destructive family of malware is an urgent obligation. The proliferation and diversity of malware make these problems more challenging. For beginners, it is arduous to attain crucial features for multi‐class family classification and extract valuable information from the obtained features. Another issue is that building a classification model that effectively absorbs multi‐class samples and adapts to various features is challenging. This work indicates a precise identification method for Android application families (ANDF) to tackle these issues. It perceptively analyzes the features that multi‐class families can utilize to identify members and further excavates the relationship between implicit information and the severity of those distinctions. A more appropriate classification model is developed for the heterogeneous file formats, and a more beneficial feature with a diverse array of heterogeneous information is chosen as the replacement representation of the sample. It is capable of upgrading learning ability and mastering the multi‐modal traits of the family malware. The application of ANDF to real data sets yields effective classification results. It is capable of 0.9800 in f1‐macro and has a classification accuracy of 98.61%. It performs, respectively, 0.0088 points better than the two‐feature comparison classification model and 0.0872 points better than the single‐feature comparison classification model. The kappa coefficient can also exceed 0.9830, which is at least 0.1044 higher than other contrasting classifiers and is 0.0105 greater than that of the contrasted model containing two features, which is 0.1046 larger than the classifier with a contrasting single feature.

Malware image classification: comparative analysis of a fine-tuned CNN and pre-trained models

A crucial part is played by malware detection and classification in ensuring the safety and security of computer systems. In this work, a comprehensive study has been presented for the classification of harmful or malware images that uses a Convolutional Neural Network (CNN) which has been finely tuned and its performance has been compared with five pre-trained models: ResNet50, InceptionResNetV2, VGG16, Xception and InceptionV3. The suggested CNN framework has been trained using the dataset MalImg_9010, consisting of 9,376 grayscale images resized to 128 × 128 pixels. The models have been evaluated based on their F1 score, recall, precision, and accuracy. The experiments that were conducted demonstrate that the fine-tuned CNN model achieves an impressive 0.965 as the F1 score and a 95.57% accuracy. Furthermore, the comparison with pre-trained models reveals the dominance of the presented framework concerning the F1 score and accuracy. The output of the conducted simulation suggests that the fine-tuned CNN approach shows promise for accurate malware image classification. Additionally, the paper discusses potential improvements, such as increasing the number of training epochs and incorporating larger and more diverse malware datasets, including RGB images and a broader range of malware families. The current research article gives valuable observations on various models’ effectiveness for classifying malware images and highlights the future scopes for research incorporating this domain.

Enhanced capsule network‐based executable files malware detection and classification—deep learning approach

SummaryMalware has considerably increased recently, posing a serious security danger to both people and enterprises. In order to distinguish and stop the negative effects of malware, a variety of machine and deep learning approaches have been used to detect it. However, while extracting malware features, the feature‐to‐feature spatial hierarchy is not taken into account by the existing techniques and as a result, information is lost during the pooling operation. Hence, a modified capsule deep neural network was developed in which discriminative features are extracted from three channel image derived from malware binary with considering feature‐to‐feature spatial hierarchy. Also, conventional capsule deep neural network is modified by adding a global average pooling layer before fully connected layer thereby classified the dataset as malicious or benign without any loss of information. Moreover, these malwares were not accurately classified based on their families using existing variants of convolutional neural network (CNN) since malware family variants can modify due to minute changes in malware binaries. Hence, a hybrid deep convolutional neural network (DCNN) and long‐short‐term memory (LSTM) has been utilized that determine minute changes in malware binaries using LSTM without vanishing gradient issue and effectively perform malware family classification using DCNN. As a result, the proposed approach successfully identifies malware in executable files and categorizes malware into families with 98.5% accuracy.

A Streamlined Framework of Metamorphic Malware Classification via Sampling and Parallel Processing

Nowadays, malware remains a significant threat to the current cyberspace. More seriously, malware authors frequently use metamorphic techniques to create numerous variants, which throws malware researchers a heavy burden. Being able to classify these metamorphic malware samples into their corresponding families could accelerate the malware analysis task efficiently. Based on our comprehensive analysis, these variants are usually implemented by making changes to their assembly instruction sequences to a certain extent. Motivated by this finding, we present a streamlined and efficient framework of malware family classification named MalSEF, which leverages sampling and parallel processing to efficiently and effectively classify the vast number of metamorphic malware variants. At first, it attenuates the complexity of feature engineering by extracting a small portion of representative samples from the entire dataset and establishing a simple feature vector based on the Opcode sequences; then, it generates the feature matrix and conducts the classification task in parallel with collaboration utilizing multiple cores and a proactive recommendation scheme. At last, its practicality is strengthened to cope with the large volume of diversified malware variants based on common computing platforms. Our comprehensive experiments conducted on the Kaggle malware dataset demonstrate that MalSEF achieves a classification accuracy of up to 98.53% and reduces time overhead by 37.60% compared to the serial processing procedure.

MalDet-Malware Detection Using Deep Learning and LSTM based Approach to Classify Malware

Computer security requires malware detection. Recent research manually uncovers hazardous features using machine learning-based techniques. MalDet, a cutting-edge malware detection method, is recommended in this paper. MalDet classifies malware using a stacking ensemble and learns from grayscale images and opcode sequences using CNN and LSTM networks. According to the evaluation, MalDet's malware detection validation accuracy is 99.89%. MalDet outperforms other previous research with 99.36% detection accuracy and a significant detection speedup on the Microsoft malware dataset. We classified nine malware families for MalDet.

A Survey of Malware Analysis Using Community Detection Algorithms

In recent years, we have witnessed an overwhelming and fast proliferation of different types of malware targeting organizations and individuals, which considerably increased the time required to detect malware. The malware developers make this issue worse by spreading many variants of the same malware [ 13 ]. To deal with this issue, graph theory techniques, and particularly community detection algorithms, can be leveraged to achieve bulk detection of malware families and variants to identify malicious communities instead of focusing on the detection of an individual instance of malware, which could significantly reduce the detection time. In this article, we review the state-of-the-art malware analysis solutions that employ community detection algorithms and provide a taxonomy that classifies the solutions with respect to five facets: analysis task, community detection approach, target platform, analysis type, and source of features. We present the solutions with respect to the analysis task, which covers malware detection, malware classification, cyber-threat infrastructure detection, and feature selection. The findings of this survey indicate that there is still room for contributions to further improve the state of the art and address research gaps. Finally, we discuss the advantages and the limitations of the solutions, identify open issues, and provide future research directions.

Conglomerate Stratum Model for Categorization of Malware Family in Image Processing

Conglomerate Stratum Model for Categorization of Malware Family in Image Processing

A Proposed Artificial Intelligence Model for Android-Malware Detection

There are a variety of reasons why smartphones have grown so pervasive in our daily lives. While their benefits are undeniable, Android users must be vigilant against malicious apps. The goal of this study was to develop a broad framework for detecting Android malware using multiple deep learning classifiers; this framework was given the name DroidMDetection. To provide precise, dynamic, Android malware detection and clustering of different families of malware, the framework makes use of unique methodologies built based on deep learning and natural language processing (NLP) techniques. When compared to other similar works, DroidMDetection (1) uses API calls and intents in addition to the common permissions to accomplish broad malware analysis, (2) uses digests of features in which a deep auto-encoder generates to cluster the detected malware samples into malware family groups, and (3) benefits from both methods of feature extraction and selection. Numerous reference datasets were used to conduct in-depth analyses of the framework. DroidMDetection’s detection rate was high, and the created clusters were relatively consistent, no matter the evaluation parameters. DroidMDetection surpasses state-of-the-art solutions MaMaDroid, DroidMalwareDetector, MalDozer, and DroidAPIMiner across all metrics we used to measure their effectiveness.

SeGDroid: An Android malware detection method based on sensitive function call graph learning

Malware is still a challenging security problem in the Android ecosystem, as malware is often obfuscated to evade detection. In such case, semantic behavior feature extraction is crucial for training a robust malware detection model. In this paper, we propose a novel Android malware detection method (named SeGDroid) that focuses on learning the semantic knowledge from sensitive function call graphs (FCGs). Specifically, we devise a graph pruning method to build a sensitive FCG on the base of an original FCG. The method preserves the sensitive API (security-related API) call context and removes the irrelevant nodes of FCGs. We propose a node representation method based on word2vec and social-network-based centrality to extract attributes for graph nodes. Our representation aims at extracting the semantic knowledge of the function calls and the structure of graphs. Using this representation, we induce graph embeddings of the sensitive FCGs associated with node attributes using a graph convolutional neural network algorithm. To provide a model explanation, we further propose a method that calculates node importance. This creates a mechanism for understanding malicious behavior. The experimental results show that SeGDroid achieves an F-score of 98% in the case of malware detection on the CICMal2020 dataset and an F-score of 96% in the case of malware family classification on the MalRadar dataset. In addition, the provided model explanation is able to trace the malicious behavior of the Android malware.

Imbalanced Malware Family Classification Using Multimodal Fusion and Weight Self-Learning

In recent years, the increasing prevalence of Intelligent Transportation Systems with advanced technologies has led to the emergence of many targeted forms of malware such as ransomware, Trojans, viruses, and malicious mining programs. And malware authors use policies like category disguise or family obfuscation in malware components to evade detection, which poses a great security threat to enterprises, government agencies, and Internet users. In this paper, we propose a malware family classification approach based on multimodal fusion and weight self-learning. Firstly, multiple modalities of malware such as byte, format, statistic, and semantic are fused in various ways to generate effective features. And then, we creatively add a weight self-learning mechanism of malware families into the classification model, which works by continuously calculating log-loss based on the family label and the probabilities predicted by each feature. The approach proves to achieve excellent classification performance on highly imbalanced malware family datasets with high efficiency and small resource overhead, which helps to identify and classify malware families and enhance the efficiency of massive malware analysis in Intelligent Transportation Systems.

DroidDetectMW: A Hybrid Intelligent Model for Android Malware Detection

Malicious apps specifically aimed at the Android platform have increased in tandem with the proliferation of mobile devices. Malware is now so carefully written that it is difficult to detect. Due to the exponential growth in malware, manual methods of malware are increasingly ineffective. Although prior writers have proposed numerous high-quality approaches, static and dynamic assessments inherently necessitate intricate procedures. The obfuscation methods used by modern malware are incredibly complex and clever. As a result, it cannot be detected using only static malware analysis. As a result, this work presents a hybrid analysis approach, partially tailored for multiple-feature data, for identifying Android malware and classifying malware families to improve Android malware detection and classification. This paper offers a hybrid method that combines static and dynamic malware analysis to give a full view of the threat. Three distinct phases make up the framework proposed in this research. Normalization and feature extraction procedures are used in the first phase of pre-processing. Both static and dynamic features undergo feature selection in the second phase. Two feature selection strategies are proposed to choose the best subset of features to use for both static and dynamic features. The third phase involves applying a newly proposed detection model to classify android apps; this model uses a neural network optimized with an improved version of HHO. Application of binary and multi-class classification is used, with binary classification for benign and malware apps and multi-class classification for detecting malware categories and families. By utilizing the features gleaned from static and dynamic malware analysis, several machine-learning methods are used for malware classification. According to the results of the experiments, the hybrid approach improves the accuracy of detection and classification of Android malware compared to the scenario when considering static and dynamic information separately.

Malware Image Classification Using Deep Learning InceptionResNet-V2 and VGG-16 Method

Malware is intentionally designed to damage computers, servers, clients or computer networks. Malware is a general term used to describe any program designed to harm a computer or server. The goal is to commit a crime, such as gaining unauthorized access to a particular system, so as to compromise user security. Most malware still uses the same code to produce another different form of malware variants. Therefore, the ability to classify similar malware variant characteristics into malware families is a good strategy to stop malware. The research is useful for classifying malware on malware samples presented as bytemap grayscale images. The malware classification research focused on 25 malware classes with a total of 9,029 images from the Malimg dataset. This research implements the VGG-16 and InceptionResNet-V2 architectures by running 2 different scenarios, scenario 1 uses the original dataset and the other scenario uses the undersampled dataset. After building the model, each scenario will get an evaluation form such as accuracy, precision, recall, and f1-score. The highest score was obtained in scenario 2 on the VGG-16 method with a score of 94.8% and the lowest in scenario 2 on the InceptionResNet-V2 method with a score of 85.1%.

Task-Aware Meta Learning-Based Siamese Neural Network for Classifying Control Flow Obfuscated Malware

Malware authors apply different techniques of control flow obfuscation, in order to create new malware variants to avoid detection. Existing Siamese neural network (SNN)-based malware detection methods fail to correctly classify different malware families when such obfuscated malware samples are present in the training dataset, resulting in high false-positive rates. To address this issue, we propose a novel task-aware few-shot-learning-based Siamese Neural Network that is resilient against the presence of malware variants affected by such control flow obfuscation techniques. Using the average entropy features of each malware family as inputs, in addition to the image features, our model generates the parameters for the feature layers, to more accurately adjust the feature embedding for different malware families, each of which has obfuscated malware variants. In addition, our proposed method can classify malware classes, even if there are only one or a few training samples available. Our model utilizes few-shot learning with the extracted features of a pre-trained network (e.g., VGG-16), to avoid the bias typically associated with a model trained with a limited number of training samples. Our proposed approach is highly effective in recognizing unique malware signatures, thus correctly classifying malware samples that belong to the same malware family, even in the presence of obfuscated malware variants. Our experimental results, validated by N-way on N-shot learning, show that our model is highly effective in classification accuracy, exceeding a rate >91%, compared to other similar methods.

Smartphone Security and Privacy: A Survey on APTs, Sensor-Based Attacks, Side-Channel Attacks, Google Play Attacks, and Defenses

There is an exponential rise in the use of smartphones in government and private institutions due to business dependencies such as communication, virtual meetings, and access to global information. These smartphones are an attractive target for cybercriminals and are one of the leading causes of cyber espionage and sabotage. A large number of sophisticated malware attacks as well as advanced persistent threats (APTs) have been launched on smartphone users. These attacks are becoming significantly more complex, sophisticated, persistent, and undetected for extended periods. Traditionally, devices are targeted by exploiting a vulnerability in the operating system (OS) or device sensors. Nevertheless, there is a rise in APTs, side-channel attacks, sensor-based attacks, and attacks launched through the Google Play Store. Previous research contributions have lacked contemporary threats, and some have proven ineffective against the latest variants of the mobile operating system. In this paper, we conducted an extensive survey of papers over the last 15 years (2009–2023), covering vulnerabilities, contemporary threats, and corresponding defenses. The research highlights APTs, classifies malware variants, defines how sensors are exploited, visualizes multiple ways that side-channel attacks are launched, and provides a comprehensive list of malware families that spread through the Google Play Store. In addition, the research provides details on threat defense solutions, such as malware detection tools and techniques presented in the last decade. Finally, it highlights open issues and identifies the research gap that needs to be addressed to meet the challenges of next-generation smartphones.

Understanding impacts of a ransomware on medical and health facilities by utilizing LockBit as a case study

AbstractAll forms of data are meant to be secured. The emergence of a variety of techniques and tactics utilized by malware authors has made recovery difficult. LockBit ransomware has been in the news and the APT behind deployment of this ransomware virus has compromised several organizations. It is important to understand the behavior of such malware, to identify the anti‐analysis stuff it performs and to block it. The APT involved compromised several health and medical facilities including AIIMS in India and Sick Kids Hospital in Canada. Ransomwares are highly impactful family of malware. Impacts may begin from confidential medical information being harvested over a C2 and can go up to rendering medical equipment useless. This article discusses compromised entities and defending strategies that can be used to block LockBit ransomware using any generic SIEM tool. It also explains the need for tools that can survive ransomware encryption, a restart command‐line and can detect the behavioral patterns of such malware. Several samples were collected from various sources; the identities of compromise were collected from strings and behavior of those samples. Several detection mechanisms including YARA, SNORT, and generic HUNT rules have also been discussed.

Privacy-preserving malware detection in Android-based IoT devices through federated Markov chains

The continuous emergence of new and sophisticated malware specifically targeting Android-based Internet of Things devices is causing significant security hazards and is consequently fostering the need for effective detection models and strategies able to work with these hardware-constrained devices. In addition, since such models are often trained on confidential application data, many involved subjects are reluctant to share their data for this purpose. Accordingly, several Federated Learning-based solutions are emerging, which rely on the capabilities of Machine Learning models in malware detection/classification without sharing user data. However, Federated Learning methods are often adversely affected by non-independent and identically distributed data in terms of both the required training time and classification results. Therefore, a promising solution could be to overcome the Federated Learning-related issues by preserving the privacy of end-user data. In this direction, the capabilities of Markov chains and associative rules are extended within a federated environment to face malware classification tasks in the IoT scenario. The presented approach, evaluated on several malware families, has achieved an average accuracy of 99% in the presence of centralized and decentralized unbalanced training/testing data by overcoming the most common state-of-the-art approaches. Also, its runtime performance is comparable with centralized ones by considering several non-independent and identically distributed dataset partitions, splitting criteria, and clients, respectively.

Dynamic Malware Analysis Based on API Sequence Semantic Fusion

The existing dynamic malware detection methods based on API call sequences ignore the semantic information of functions. Simply mapping API to numerical values does not reflect whether a function has performed a query or modification operation, whether it is related to network communication, the file system, or other factors. Additionally, the detection performance is limited when the size of the API call sequence is too large. To address this issue, we propose Mal-ASSF, a novel malware detection model that fuses the semantic and sequence features of the API calls. The API2Vec embedding method is used to obtain the dimensionality reduction representation of the API function. To capture the behavioral features of sequential segments, Balts is used to extract the features. To leverage the implicit semantic information of the API functions, the operation and the type of resource operated by the API functions are extracted. These semantic and sequential features are then fused and processed by the attention-related modules. In comparison with the existing methods, Mal-ASSF boasts superior capabilities in terms of semantic representation and recognition of critical sequences within API call sequences. According to the evaluation with a dataset of malware families, the experimental results show that Mal-ASSF outperforms existing solutions by 3% to 5% in detection accuracy.

ImageDroid: Using Deep Learning to Efficiently Detect Android Malware and Automatically Mark Malicious Features

The popularity of the Android platform has led to an explosion in malware. The current research on Android malware mainly focuses on malware detection or malware family classification. These studies need to extract a large number of features, which consumes a lot of manpower and material resources. Moreover, some malware use obfuscation to evade decompiler tools extracting features. To address these problems, we propose ImageDroid, a method based on the image format of Android applications that can not only detect and classify malware without prior knowledge but also detect the obfuscated malware. Furthermore, we utilize the Grad-CAM interpretable mechanism of the deep learning model to automatically label the image that play a key role in determining maliciousness in a visual way. We evaluate ImageDroid over 10,000 Android applications. Experimental results show that the accuracy of malicious detection and multifamily classification achieve 97.2% and 95.1%, respectively, and the detection accuracy of obfuscated malware achieves 94.6%.

Proposing the application of a deep learning model to detect the malicious IP address of botnet in the computer network

Abstract— Malware in general and botnets in particular are big threats to cybersecurity. They have many sophisticated methods to bypass security systems to infect computers and perform attacks, sabotage, or spying activities. Botnet detection solutions are always focused on and solved by scientists and cybersecurity specialists. The DGA botnet is a group of common botnet families that share the same mechanism of needing to connect back to the C&C server via DNS to receive commands to operate. Many studies that propose algorithms for detecting and classifying DGA botnets have been proposed and tested with high results. In this study, we approach by using the above solutions to detect malicious IP addresses and botnet malware families. First, we evaluate the efficiency of two deep learning models LA_Bin07 and LA_Mul07 on a new specialized dataset, UTL_DGA22. Next, we extended the experiment with the ISCX-Bot-2014 dataset. The results show that LA_Bin07 and LA_Mul07 models both get high accuracy on the new dataset, with 0.98 and 0.86 correspondingly. Experimenting on the reality dataset also gives positive results, helping network administrators to localize malicious IP addresses for deeper investigation. The proposed solution is effective enough to be applied as a module in cybersecurity solutions such as firewalls, intrusion detection, and prevention systems or unified thread management - UTM.

Development of a deep stacked ensemble with process based volatile memory forensics for platform independent malware detection and classification

Malware has become more complicated in its purpose and abilities over time, demanding continuous progress in detection and defense technologies. Malware designers use anti-analysis obfuscation techniques, including packing and encryption, to evade detection and hinder the analysis process. Current malware detection methods have shortcomings; thus, an alternative dynamic platform-independent scheme is proposed to extract harmful hardware impressions. This scheme includes extracting and converting a file from process memory dumps into an image. A combined structural and statistical image textural analysis is performed by designing a hybrid local and global feature descriptor. The hybrid feature descriptor helps to improve the data training ability of the proposed deep-stacked ensemble model by reducing input dimensions. A deep-stacked ensemble model is developed by combining prediction outputs from weak learners (CNNs) and feeding them into a meta-learner (MLP) as learning input. An explainable artificial intelligence-based approach is employed to interpret and validate the final results of the proposed scheme. Evaluations are conducted using three datasets: the publicly available Dumpware10 dataset, which contains 3686 samples from 10 different malware families; the publicly available CIC-MalMem-2022 dataset, which includes 2,916 samples from 15 different obfuscated malware families; and a real-world dataset, which contains 2375 samples of both malware and benign android apps. Experimental outcomes show that the proposed scheme achieved 99.1 % accuracy in analyzing Windows malware memory dumps, 94.3 % accuracy in analyzing Android malware memory dumps, and 99.8 % accuracy in analyzing Windows obfuscated malware memory dumps. The final results indicate that our vision-based system provides an excellent defense against malicious programs.