Antivirus Research Articles

A robust malware traffic classifier to combat security breaches in industry 4.0 applications

SummaryIndustry 4.0 integrates cyber systems, physical devices, and digital networks to automate the industrial process. Many sectors aim to adopt the best practices outlined in Industry 4.0. This indicates well for the future networking of an increasing number of devices. As crucial as intelligent automation is, it is essential that it be protected. The proliferation of Internet‐enabled gadgets could raise vulnerability to a variety of threats, malware among them. Intruders see a synthesis of factors as a chance to carry out their malicious plan. Keeping sensitive data and information protected from malicious software is a high responsibility for all industries. It is critical to have both a trustworthy approach and a large dataset to work with when constructing a malware traffic classifier. Malware's capacity to elude detection by antivirus programs improves with the day. Because this malware has the potential to compromise the entire network, establishing a malware traffic classifier requires a strong approach. As the number of data increases, the classifier has a harder time distinguishing between benign and malicious network entries. As a result, weighing too many factors is a time‐consuming process. To assist with these types of real‐world challenges, we construct an effective hybrid selection component, which is subsequently followed by a neural network classifier in this research. The Malware traffic classifier provided here selects the principal feature using filter and wrapper techniques. The feature columns provided by the feature selection program are used to construct a neural network‐based binary malware classifier. The given malware traffic classification framework was tested using the MTA‐KDD'19 dataset. We set up an experiment in this investigation to examine the way different feature counts perform using a neural‐based classifier. The suggested framework achieves 96.8% accuracy while just considering the bare minimum of five features, which is a substantial increase over alternative methods.

Bad USB as HID and it’s Mitigations

Abstract: A bug known as "Bad USB" allows a hacker to manipulate a USB flash drive's firmware. Malicious code is automatically activated when the Bad USB device is connected into the USB port of the host system. It is challenging to identify the malicious code since the host system interprets the harmful activities as legitimate ones required to load the USB device. Additionally, antivirus software is unable to detect firmware that has been modified because it examines the storage region rather than the firmware area. The vulnerability has a detrimental knock-on impact since a large number of computer peripherals (similar to USB flash drives, keyboards) are connected to the host machine using the USB protocols. Universal Serial Bus (USB) has become the primary connecting port for cutting-edge computers as a result of its universality. Programmability makes it easier for operating system and tackle manufacturers to develop their goods and associated firmware, but as of right now, a fix for the issue is unknown. In this article, we analyze the tampered area of the firmware that occurs when a good USB device is switched out with a bad one and provide a fix to ensure the integrity of the area when the USB thrills

Antivirus Evasion Methods in Modern Operating Systems

In order to safeguard one’s privacy while accessing the internet, it is crucial to have an antivirus program installed on the device. Despite their usefulness in protecting against malware, these programs are not foolproof. Cybercriminals have access to numerous techniques and tools for circumventing antivirus software, which can greatly aid them in their illicit activities. The objective of this research was to examine the most prevalent methods and tools for bypassing antivirus software and to demonstrate how readily accessible and simple they are to use. The aim of this paper is to raise awareness among readers about the associated risks and to assist internet users in protecting themselves from potential threats. The findings of the research indicate that the efficacy of evasion tools is positively correlated with their age and popularity. Tests have shown that, with the latest updates, contemporary antivirus software is capable of resisting virtually all of the tested methods generated using default settings. However, the most significant aspect of this paper is the section presenting experiments with basic but powerful modifications to established evasion mechanisms, which have been found to deceive modern, up-to-date antivirus software.

A novel hybrid ensemble learning for anomaly detection in industrial sensor networks and SCADA systems for smart city infrastructures

Critical Infrastructures (CIs) use Supervisory Control and Data Acquisition (SCADA) systems for monitoring and remote control. Sensor networks are being integrated into all areas of the infrastructures of smart cities. The sensor network data stream contains information that can be utilized to model and control the activity of these infrastructures. However, SCADA systems are constantly exposed to a variety of diverse intrusions, making detection with traditional intrusion detection systems (IDS) extremely difficult. Due to their unique specifications, conventional security solutions, like antivirus and firewall software, are unsuitable for properly securing SCADA systems. In addition, anomaly detection in industrial sensor networks (ISNs) should occur in real time. Therefore, effectively identifying cyberattacks in major SCADA systems is unquestionably essential for enhancing their resilience, ensuring safe operations, and avoiding expensive maintenance. We developed a novel hybrid ensemble model approach to address these issues. This paper's primary objective is to detect hostile intrusions that have already circumvented firewalls and typical IDS. In this paper, we propose a hybrid Ensemble Learning Model (ELM) for intrusion detection in SCADA systems with ISNs utilizing a tangible data gathered from a gas pipeline system given by Mississippi State University (MSU), the water system, and the high-dimensional University of New South Wales-NB 2015 (UNSW-NB15) data that reflects a typical attack in the Internet of Things (IoT) environment. The unity normalization method was adopted for data preprocessing, and the Principal Component Analysis (PCA) was utilized for feature extraction of the high-dimensional datasets. Grey Wolf Optimizer (GWO) was used for optimizing the bagging, stacking, Adaboost, and an ensemble of classifiers Naive Bayes and Support Vector Machine with a majority voting technique. Then, we utilized the proposed approach founded on the bijective soft-set approach for efficient ELM selection. The experiment was conducted in two phases: Initially, without PCA + GWO for feature extraction and selection on the ELM, and subsequently, with PCA + GWO for feature extraction and selection on the ELM. PCA + GWO on the ensemble of classifiers NB + SVM provided an accuracy of 99%, precision of 100%, recall of 100%, and detection rate of 99.90%, outpacing the ensemble of classifiers without PCA feature extraction and GWO optimization approaches.

Cyber Security Attacks Detecting Thread in the Virtual World of Corporate Sectors

Purpose: Attempting to get access to a computer, computer network, or computing system without authorization is known as a cyber-attack. To modify, impede, erase, manipulate or steal data from computer systems is the purpose of a cyber-attack. These attacks may be carried out in a number of ways. This placeholder information is used to identify a single instance of the use of a prgramme that may support numerous users at once. A thread is information that a programme requires to serve a single user or a single service request. Cybercriminals make use of technology to do malicious actions on digital systems or networks in order to make a profit. These crimes include hacking computer systems and stealing confidential information from businesses and individuals. A thorough study on the algorithms to detect threats in the virtual world of corporate sectors. Finding/Result: Researchers are using a wide array of deep learning algorithms to achieve this goal, and the results have been rather impressive. A system like this may provide substandard results because to its limited ability to describe the problem area and the complexity of its modeling of hazardous behaviours. Supervised learning systems often deliver a high level of accuracy because of the large amount of data made available by manually labelled samples. Originality/Value: Antivirus software is an absolute need for any and all computers. The vast majority of antivirus software is able to identify malicious software such as malware, spyware, ransomware, and harmful email attachments. Paper Type: Literature Review.

Detecting Remote Access Network Attacks Using Supervised Machine Learning Methods

Remote access technologies encrypt data to enforce policies and ensure protection. Attackers leverage such techniques to launch carefully crafted evasion attacks introducing malware and other unwanted traffic to the internal network. Traditional security controls such as anti-virus software, firewall, and intrusion detection systems (IDS) decrypt network traffic and employ signature and heuristic-based approaches for malware inspection. In the past, machine learning (ML) approaches have been proposed for specific malware detection and traffic type characterization. However, decryption introduces computational overheads and dilutes the privacy goal of encryption. The ML approaches employ limited features and are not objectively developed for remote access security. This paper presents a novel ML-based approach to encrypted remote access attack detection using a weighted random forest (W-RF) algorithm. Key features are determined using feature importance scores. Class weighing is used to address the imbalanced data distribution problem common in remote access network traffic where attacks comprise only a small proportion of network traffic. Results obtained during the evaluation of the approach on benign virtual private network (VPN) and attack network traffic datasets that comprise verified normal hosts and common attacks in real-world network traffic are presented. With recall and precision of 100%, the approach demonstrates effective performance. The results for k-fold cross-validation and receiver operating characteristic (ROC) mean area under the curve (AUC) demonstrate that the approach effectively detects attacks in encrypted remote access network traffic, successfully averting attackers and network intrusions.

The disappearance of respiratory syncytial virus and influenza viruses in children during the second year of the COVID-19 pandemic - are non-pharmaceutical interventions as effective as vaccines?

Respiratory viral diseases are common in children. A viral diagnostic test is necessary, because COVID-19 shows signs and symptoms similar to those of common respiratory viruses. The article aims at analyzing the presence of respiratory viruses that were common before the pandemic in children who were tested for suspected COVID-19, and is also concerned with how common respiratory viruses were impacted by COVID-19 measures during the second year of pandemic. Nasopharyngeal swabs were examined to detect the presence of respiratory viruses. The respiratory panel kit included SARS-CoV-2, influenza A and B, rhinovirus/enterovirus, parainfluenza 1, 2, 3 and 4, coronaviruses NL 63, 229E, OC43, and HKU1, human metapneumovirus A/B, human bocavirus, respiratory syncytial virus (RSV) A/B, human parechovirus, and adenovirus. Virus scans were compared during and after the restricted period. No virus was isolated from the 86 patients. SARS-CoV-2 was the most frequently observed virus, as expected, and rhinovirus was the second, and coronavirus OC43 was the third. Influenza viruses and RSV were not detected in the scans. Influenza and RSV viruses disappeared during the pandemic period and rhinovirus was the second most common virus after the CoVs during and after the restriction period. Non-pharmaceutical interventions should be established as a precaution to prevent infectious diseases even after the pandemic.

A Review on Major Cyber Threats and Recommended Counter Measures

Abstract: It was predicted that the number of cyber attacks will rise by a factor of two every year. There have been several highprofile cyber attacks on government organizations in India in recent years. Ransomware attacks, Advanced Persistent Threats, Internet of Things, Cloud security risks, Insider threats, Social engineering attacks, Supply chain attacks, Zero-day exploits in cyber threats are some of the significant types of cyber attacks affecting Indian government entities. Security measures, such as regularly backing up important data, installing antivirus software, training employees on how to identify and avoid phishing emails, and maintaining up-to-date software and operating systems are common countermeasures against significant cyber attacks. Preventing cyber attacks requires a multi-layered approach that addresses vulnerabilities in people, processes, and technology. Empowering, the agencies like CERT-In for cyber resilience, strengthening the penalty framework for noncompliance, advisories on information and data security practices are some of the strategies adopted by the government to secure cyberspace. It is necessary to stay informed about the latest threats and continually reassess and update security measures as needed.

MalBERTv2: Code Aware BERT-Based Model for Malware Identification

To proactively mitigate malware threats, cybersecurity tools, such as anti-virus and anti-malware software, as well as firewalls, require frequent updates and proactive implementation. However, processing the vast amounts of dataset examples can be overwhelming when relying solely on traditional methods. In cybersecurity workflows, recent advances in natural language processing (NLP) models can aid in proactively detecting various threats. In this paper, we present a novel approach for representing the relevance and significance of the Malware/Goodware (MG) datasets, through the use of a pre-trained language model called MalBERTv2. Our model is trained on publicly available datasets, with a focus on the source code of the apps by extracting the top-ranked files that present the most relevant information. These files are then passed through a pre-tokenization feature generator, and the resulting keywords are used to train the tokenizer from scratch. Finally, we apply a classifier using bidirectional encoder representations from transformers (BERT) as a layer within the model pipeline. The performance of our model is evaluated on different datasets, achieving a weighted f1 score ranging from 82% to 99%. Our results demonstrate the effectiveness of our approach for proactively detecting malware threats using NLP techniques.

Stealing and evading malware classifiers and antivirus at low false positive conditions

Model stealing attacks have been successfully used in many machine learning domains, but there is little understanding of how these attacks work against models that perform malware detection. Malware detection and, in general, security domains have unique conditions. In particular, there are very strong requirements for low false positive rates (FPR). Antivirus products (AVs) that use machine learning are very complex systems to steal, malware binaries continually change, and the whole environment is adversarial by nature. This study evaluates active learning model stealing attacks against publicly available stand-alone machine learning malware classifiers and also against antivirus products. The study proposes a new neural network architecture for surrogate models (dualFFNN) and a new model stealing attack that combines transfer and active learning for surrogate creation (FFNN-TL). We achieved good surrogates of the stand-alone classifiers with up to 99% agreement with the target models, using less than 4% of the original training dataset. Good surrogates of AV systems were also trained with up to 99% agreement and less than 4000 queries. The study uses the best surrogates to generate adversarial malware to evade the target models, both stand-alone and AVs (with and without an internet connection). Results show that surrogate models can generate adversarial malware that evades the targets but with a lower success rate than directly using the target models to generate adversarial malware. Using surrogates, however, is still a good option since using the AVs for malware generation is highly time-consuming and easily detected when the AVs are connected to the internet.

GooseBt: A programmable malware detection framework based on process, file, registry, and COM monitoring

As the networks is becoming faster and more convenient, computers is communicating with each other more and more frequent. However, security of computer communication is required to be concerned. Thus, this paper introduces a new programmable malware detection framework under Windows platform named GooseBt based on process, file, registry, and COM monitoring, which provides a new thought to perform malware detection. Usually, it is quite difficult to design with various kernel drivers on different platform versions, which are required to be developed before malware detection methods could be addressed. Moreover, most kinds of the existing anti-virus software are not programmable. In GooseBt framework, users can directly use easy codes to design their malware detection methods and make it run in Windows kernel mode. Static rules and dynamic rules are provided as interfaces based on message mapping. Moreover, third-party anti-virus manufacturers can directly call the API of the framework. The framework is proved to be effective and stable.

Deciphering the molecular mechanisms of Maxing Huoqiao Decoction in treating pulmonary fibrosis via transcriptional profiling and circRNA-miRNA-mRNA network analysis

BackgroundIdiopathic pulmonary fibrosis (IPF) is a chronic, progressive, fibrotic interstitial lung condition with unknown etiology and high mortality. Chinese herbal medicine has been used for more than a thousand years to treat various lung diseases. PurposeThe current study aimed to examine whether Chinese herbal Maxing Huoqiao Decoction (MXHQD) exerts therapeutic effects on IPF and to further uncover its underlying molecular mechanisms. MethodsMouse model of acute lung injury (ALI) or IPF was induced by intratracheal instillation of LPS or bleomycin, respectively. ALI mice were treated with MXHQD for 7 days, and lung tissues were taken for test after modeling 24 h. IPF mice were gavaged for 21 days after modeling. Lung tissues were subjected to whole transcriptome detection, and the differential RNAs were experimentally verified. ResultsThe results showed that MXHQD alleviated the computed tomography (CT) and the pathological degree changes in mice with IPF, improved changes in the expression of fibrosis related genes and reduced the hydroxyproline expression in IPF mice. MXHQD also decreased the cell numbers in bronchoalveolar lavage fluids, and the expression levels of the inflammatory factors in the ALI mice lung tissues were significantly inhibited. By applying whole transcriptome analysis, results showed that MXHQD acted on 40 mRNAs, 15 miRNAs, 25 novel lncRNAs and 17 circRNAs to resist pulmonary fibrosis. The competing endogenous RNA (ceRNA) network diagram showed that the multiple components of MXHQD against fibrosis through a network of multiple targets. The differential mRNAs were mainly related to the innate immune response and the defense response to virus. Then the expression of mRNAs in the differential mRNA-miRNA-differential circRNA network in the lung tissue of IPF was verified. The expression of ZBP1 and ISG15 related to immune system and anti virus was verified at both gene and protein expressions. MXHQD could significantly inhibit the elevation of ZBP1 and ISG15 factors induced by the fibrosis model. ConclusionOverall, our findings provide compelling evidence that MXHQD can alleviate IPF by modulating innate immunity. This is the first study to reveal the molecular mechanism underlying the multi-components, multi-channels and multi-targets anti-IPF immune injury of MXHQD, and supports its potential clinical application for IPF.

A Comprehensive Review of Cyber Security Vulnerabilities, Threats, Attacks, and Solutions

Internet usage has grown exponentially, with individuals and companies performing multiple daily transactions in cyberspace rather than in the real world. The coronavirus (COVID-19) pandemic has accelerated this process. As a result of the widespread usage of the digital environment, traditional crimes have also shifted to the digital space. Emerging technologies such as cloud computing, the Internet of Things (IoT), social media, wireless communication, and cryptocurrencies are raising security concerns in cyberspace. Recently, cyber criminals have started to use cyber attacks as a service to automate attacks and leverage their impact. Attackers exploit vulnerabilities that exist in hardware, software, and communication layers. Various types of cyber attacks include distributed denial of service (DDoS), phishing, man-in-the-middle, password, remote, privilege escalation, and malware. Due to new-generation attacks and evasion techniques, traditional protection systems such as firewalls, intrusion detection systems, antivirus software, access control lists, etc., are no longer effective in detecting these sophisticated attacks. Therefore, there is an urgent need to find innovative and more feasible solutions to prevent cyber attacks. The paper first extensively explains the main reasons for cyber attacks. Then, it reviews the most recent attacks, attack patterns, and detection techniques. Thirdly, the article discusses contemporary technical and nontechnical solutions for recognizing attacks in advance. Using trending technologies such as machine learning, deep learning, cloud platforms, big data, and blockchain can be a promising solution for current and future cyber attacks. These technological solutions may assist in detecting malware, intrusion detection, spam identification, DNS attack classification, fraud detection, recognizing hidden channels, and distinguishing advanced persistent threats. However, some promising solutions, especially machine learning and deep learning, are not resistant to evasion techniques, which must be considered when proposing solutions against intelligent cyber attacks.

Replacement of imported software for modern Russian companies and businesses

In 2022 and 2023, many specialists from various industries and businesses will actively witness the process of import substitution in many business segments. For many Russian companies, the question of how to switch to domestic software without loss of quality and maintaining work efficiency is relevant. The analytical review contains a description of the key solutions available to support the functioning of companies of any size: operating systems, office systems, enterprise systems of the ERP and CRM class, antivirus programs. In conclusion, the possibility of using domestic software is summed up.

Community Learning Understanding The Distribution of Pandemy Virus C-19 Through Etes Anti Virus Products

The Covid-19 pandemic that hit the world paralyzed human immunity and disrupted the learning process at the school unit level and the community’s economy was also disrupted. Various government agencies, the private sector, universities, companies and other non-governmental organizations are making efforts in handling this pandemic. STKIP NiasSelatan as a university located in the western region of Indonesia and farthest from the mainland of North Sumatra conducted a trial for making anti-virus disinfectants. Understanding the chemical elements that exist in the form of Ca, Cl2, O2, H2, and C is expected to be able to solve the problems faced by the world and especially on the island of Nias together. With all the existing limitations, an anti-virus material that is able to prevent Covid-19 is produced by using ethanol, disinfectant and stabilizer. Through this compound produces ETES. This product is believed and proven to be able to eradicate germs and even viruses. ETES as a product containing liquid air components is able to ward off foreign objects or creatures that stick to the surface of the skin and the surface of objects used by humans. By warding off foreign creatures on the surface of human skin, it can prevent the virus from entering the body after using ETES. To minimize and prevent the spread of the corona virus, this product helps educate the public to maintain health with health protocols as the world participates jointly in non-natural disaster management.
 Keywords: Community learning; ETES; anti virus

Semantics-Preserving Reinforcement Learning Attack Against Graph Neural Networks for Malware Detection

As an increasing number of deep-learning-based malware scanners have been proposed, the existing evasion techniques, including code obfuscation and polymorphic malware, are found to be less effective. In this work, we propose a reinforcement learning based semantics-preserving (i.e. functionality-preserving) attack against black-box GNNs (Graph Neural Networks) for malware detection. The key factor of adversarial malware generation via semantic <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Nops</monospace> insertion is to select the appropriate semantic <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Nops</monospace> and their corresponding basic blocks. The proposed attack uses reinforcement learning to automatically make these “how to select” decisions. To evaluate the attack, we have trained two kinds of GNNs with three types (e.g., Backdoor, Trojan, and Virus) of Windows malware samples and various benign Windows programs. The evaluation results have shown that the proposed attack can achieve a significantly higher evasion rate than four baseline attacks, namely the binary diversification attack, the semantics-preserving random instruction insertion attack, the semantics-preserving accumulative instruction insertion attack, and the semantics-preserving gradient-based instruction insertion attack.

Sosialisasi Enam Langkah Cuci Tangan Pada Anak Di SD Negeri 2 Kairatu Pada Masa Pandemi Covid-19

Washing hands as often as possible and using the six steps for washing children's hands is one of the most important steps to prevent Covid-19 infection in children. Washing your hands with soap is much more effective at killing germs, bacteria and viruses compared to washing your hands using just water. Soap can easily destroy the Covid-19 lipid membrane, making the Covid-19 virus inactive. The aim of this activity is to increase knowledge among elementary school students, by socializing the six steps for washing hands among elementary school children during the Covid-19 pandemic at SD Negeri 2 Kairatu, Kairatu Village. The method for implementing this activity is in the form of health education about six-step hand washing, the benefits of hand washing, and a demonstration of six-step hand washing by grade 3 elementary school students at SD Negeri 2 Kairatu. The results of this community service activity were an increase in children's knowledge regarding the 6 (six) steps for correct hand washing.

METHOD FOR DETECTION OF RANSOMWARE CYBER THREATS BASED ON HONEYPOT: STATE-OF-ART

The work presents the research of the methods for detecting cyber threats such as Ransomware based on the use of Honeypot. Today, lack of awareness allows attacks to bypass basic security mechanisms, security vulnerabilities in the IT systems of small and large corporations are increasingly being used to cause business failures. The cyberattackscontinue to expand rapidly as cybercriminals constantly bypass the security tools developed and implemented by organizations. The purpose of attacks is increasingly data that is critical to both individuals and organizations. Attackers use capabilitiesthat can help them seize control of valuable data to demand a ransom from the data owner. Ransomware is a form of malware that infects a computer or multiple computers over a network by encrypting files and folders, making them unusable. The users are then asked to make a ransom. Ransomware is not a new threat, but its use is growing rapidly and causing large financial losses in the world. This is a serious challenge for cybersecurity analysts because typical ransomware is not detected by antivirus software due to its polymorphic nature. There was a sudden surge in extremely dangerous ransomware attacks that harmed most companies and individuals. Ransomware poses a great threat and must be fought at a global level. There is a lack of comprehensive analysis to cover the security issues of individual users and corporations. Ransomware avoidance methods are the most effective and require special attention as the reduction and recovery of ransomware becomes increasingly difficult. The task arises to investigate the effectiveness of known methods in order to assess and identify their advantages and disadvantages, which will allow in the future to develop and implement new effective methods and means of combating Ransomware-type SPZ based on the use of Honeypot. The study shows that because malware is automated and targets any location arbitrarily, placing the bait anywhere to detect activity is an improvement over the lack of monitoring at all. Experimental studies indicate a high reliability of the proposed methods, in particular the reliability of the detection of cyber threats of the Ransomware type, but the insufficient adaptability of these methods in the evolution of the malware.

MOJI: Character-level convolutional neural networks for Malicious Obfuscated JavaScript Inspection

JavaScript malware is one of the major threats to web security. A big challenge in detecting such malicious JavaScript is obfuscation, which transforms a program code into a harder-to-understand representation while preserving its original functionality. Many malicious JavaScript detection methods perform code abstraction and prior feature extraction to uncover the functionality hidden by obfuscation. However, such preprocessing steps significantly limit the detectors’ efficiency in practical situations. This paper presents Malicious Obfuscated JavaScript Inspector (MOJI), a novel method for malicious JavaScript detection, which requires no code abstraction or prior feature extraction. Instead, our detector directly accepts a sequence of characters in JavaScript code as an input and outputs its maliciousness score. Specifically, we design a character-level convolutional neural network consisting mainly of several 1D convolutional layers and fully connected layers. We evaluate the proposed method on a dataset composed of 24,000 JavaScript codes and show that our method outperforms existing malicious JavaScript detectors in terms of both detection performance and running time. We also provide an analysis of the effect of additional obfuscation on the same dataset. Our results indicate that MOJI is far more robust to obfuscation than the existing methods and commercial antivirus software.

Efficient feature extraction methodologies for unknown MP4-Malware detection using Machine learning algorithms

We are living in an era in which daily interaction between individuals and businesses involves sending, uploading, and sharing videos as a means of communication and advertising. However, many users are unaware of the risks associated with opening a malicious video file, it is thus no surprise that cyber-criminals have taken advantage of this situation and adopted this attack vector in recent years. MP4 is one of the most commonly used video formats, and its properties make it well-suited for software vulnerability exploitation across multiple platforms, which can ultimately lead to a cyberattack. Due to their deterministic, signature-based technique, antivirus software solutions are limited in their ability to detect unknown malware, let alone zero-day attacks. Machine learning (ML) algorithms have been effective in detecting known and unknown malware across various file formats, domains, and platforms. ML algorithms’ performance relies heavily on the feature extraction methodology. However, to the best of our knowledge, there is no designated and specialized feature extraction methodology for MP4 files which generates a set of features for the task of unknown MP4 file malware detection. In this paper, we present three innovative and efficient feature extraction methodologies for unknown MP4 file malware detection. Two of them are file structure-based and one is knowledge-based. The methodologies are evaluated in a series of five experiments using six ML algorithms and 177 different datasets which represent different configurations of feature extraction, representation, and selection. The datasets are based on a representative collection of 6,229 files − 5,066 benign (∼81.3 %) files and 1,163 malicious files (∼18.7 %). The first three experiments demonstrate the methodologies’ discrimination and generalization capabilities across multiple configurations, in terms of known and unknown MP4 file malware detection. The fourth experiment shows that applying principal component analysis (PCA) on the features suggested by the methodologies can improve time and space complexity and feature resilience while maintaining strong detection and generalization capabilities. In the fifth experiment, the methodologies’ best performing configuration is compared to state-of-the-art, generic feature extraction methodologies, such as n-grams, MinHash, and representation and transfer learning (using a CNN), in the task of unknown MP4 file malware detection. The results show that our best performing configuration outperforms all other state-of-the-art feature extraction methodologies with an AUC, TPR, and FPR of 0.9951, 0.976, and 0.0 respectively.