Malware Detection Method Research Articles

Task-Aware Meta Learning-Based Siamese Neural Network for Classifying Control Flow Obfuscated Malware

Malware authors apply different techniques of control flow obfuscation, in order to create new malware variants to avoid detection. Existing Siamese neural network (SNN)-based malware detection methods fail to correctly classify different malware families when such obfuscated malware samples are present in the training dataset, resulting in high false-positive rates. To address this issue, we propose a novel task-aware few-shot-learning-based Siamese Neural Network that is resilient against the presence of malware variants affected by such control flow obfuscation techniques. Using the average entropy features of each malware family as inputs, in addition to the image features, our model generates the parameters for the feature layers, to more accurately adjust the feature embedding for different malware families, each of which has obfuscated malware variants. In addition, our proposed method can classify malware classes, even if there are only one or a few training samples available. Our model utilizes few-shot learning with the extracted features of a pre-trained network (e.g., VGG-16), to avoid the bias typically associated with a model trained with a limited number of training samples. Our proposed approach is highly effective in recognizing unique malware signatures, thus correctly classifying malware samples that belong to the same malware family, even in the presence of obfuscated malware variants. Our experimental results, validated by N-way on N-shot learning, show that our model is highly effective in classification accuracy, exceeding a rate >91%, compared to other similar methods.

MalAnalyser: An effective and efficient Windows malware detection method based on API call sequences

Continuously evolving malware and their variants pose severe threats to information systems. API call sequence based methodologies perform well in malware detection but often suffer from high-dimensional feature sets or loss of information. Malware developers take advantage of this situation and use sophisticated coding/ obfuscation techniques to add, remove, and replace redundant API calls in malware and evade existing detection mechanisms. To address these concerns, we propose a novel and lightweight API call sequence-based Windows malware detection system, MalAnalyser. Specifically, it first extracts frequent API call subsequences (patterns) from API call sequences because frequent patterns filter superfluous API calls and highlight useful information about malware samples. Thereafter, it applies Global Local Best Particle Swarm Optimization (GLBPSO) algorithm on frequent patterns and identifies a small set of significant features that contribute to malware detection. Finally, MalAnalyser enriches frequent malware patterns using Genetic Algorithm (GA) to unveil unseen malware behavior. Extensive experimentation was conducted to evaluate the performance of MalAnalyser on different datasets and scenarios. GLBPSO considered two feature sets as input during experimentation: (i) the entire feature set and (ii) 60% randomly selected features from the entire set. Experimentation results prove that MalAnalyser attains up to 99.7% accuracy using approximately 30% features of the entire feature set. It is important to note that MalAnalyser achieves up to 100% accuracy on GA enriched feature set. Further, we evaluate the performance of MalAnalyser on a benchmark dataset, and the results proved that MalAnalyser outperforms similar approaches by achieving 99.72% accuracy. Additionally, we determined the suitability of MalAnalyser against a specific type of malware i.e. ransomware, and results showed that MalAnalyser performed remarkably well on ransomware dataset as well.

A Malware Detection and Extraction Method for the Related Information Using the ViT Attention Mechanism on Android Operating System

Artificial intelligence (AI) is increasingly being utilized in cybersecurity, particularly for detecting malicious applications. However, the black-box nature of AI models presents a significant challenge. This lack of transparency makes it difficult to understand and trust the results. In order to address this, it is necessary to incorporate explainability into the detection model. There is insufficient research to provide reasons why applications are detected as malicious or explain their behavior. In this paper, we propose a method of a Vision Transformer(ViT)-based malware detection model and malicious behavior extraction using an attention map to achieve high detection accuracy and high interpretability. Malware detection uses a ViT-based model, which takes an image as input. ViT offers a significant advantage for image detection tasks by leveraging attention mechanisms, enabling robust interpretation and understanding of the intricate patterns within the images. The image is converted from an application. An attention map is generated with attention values generated during the detection process. The attention map is used to identify factors that the model deems important. Class and method names are extracted and provided based on the identified factors. The performance of the detection was validated using real-world datasets. The malware detection accuracy was 80.27%, which is a high level of accuracy compared to other models used for image-based malware detection. The interpretability was measured in the same way as the F1-score, resulting in an interpretability score of 0.70. This score is superior to existing interpretable machine learning (ML)-based methods, such as Drebin, LIME, and XMal. By analyzing malicious applications, we also confirmed that the extracted classes and methods are related to malicious behavior. With the proposed method, security experts can understand the reason behind the model’s detection and the behavior of malicious applications. Given the growing importance of explainable artificial intelligence in cybersecurity, this method is expected to make a significant contribution to this field.

Obfuscated Memory Malware Detection in Resource-Constrained IoT Devices for Smart City Applications.

Obfuscated Memory Malware (OMM) presents significant threats to interconnected systems, including smart city applications, for its ability to evade detection through concealment tactics. Existing OMM detection methods primarily focus on binary detection. Their multiclass versions consider a few families only and, thereby, fail to detect much existing and emerging malware. Moreover, their large memory size makes them unsuitable to be executed in resource-constrained embedded/IoT devices. To address this problem, in this paper, we propose a multiclass but lightweight malware detection method capable of identifying recent malware and is suitable to execute in embedded devices. For this, the method considers a hybrid model by combining the feature-learning capabilities of convolutional neural networks with the temporal modeling advantage of bidirectional long short-term memory. The proposed architecture exhibits compact size and fast processing speed, making it suitable for deployment in IoT devices that constitute the major components of smart city systems. Extensive experiments with the recent CIC-Malmem-2022 OMM dataset demonstrate that our method outperforms other machine learning-based models proposed in the literature in both detecting OMM and identifying specific attack types. Our proposed method thus offers a robust yet compact model executable in IoT devices for defending against obfuscated malware.

An optimal deep learning-based framework for the detection and classification of android malware

The use of smartphones is increasing rapidly and the malicious intrusions associated with it have become a challenging task that needs to be resolved. A secure and effective technique is needed to prevent breaches and detect malicious applications. Through deep learning methods and neural networks, the earliest detection and classification of malware can be performed. Detection of Android malware is the process to identify malicious attackers and through the classification method of malware, the type is categorized as adware, ransomware, SMS malware, and scareware. Since there were several techniques employed so far for malware detection and classification, there were some limitations like a reduced rate of accuracy and so on. To overcome these limitations, a deep learning-based automated process is employed to identify the malware. In this paper, initially, the datasets are collected, and through the preprocessing method, the duplicate and noisy data are removed to improve accuracy. Then the separated malware and benign dataset from the preprocessing phase is dealt with in feature selection. The reliable features are extracted in this process by Meta-Heuristic Artificial Jellyfish Search Optimizer (MH-AJSO). Further by the process of classification, the type of malware is categorized. The classification method is performed by the proposed Dense Dilated ResNet101 (DDResNet101) classifier. According to the type of malware the breach is prevented and secured on the android device. Although several methods of malware detection are found in the android platform the accuracy is effectively derived in our proposed system. Various performance analysis is performed to compare the robustness of detection. The results show that better accuracy of 98% is achieved in the proposed model with effectiveness for identifying the malware and thereby breaches and intrusion can be prevented.

Fisher exact Boschloo and polynomial vector learning for malware detection

Computer technology shows swift progress that has infiltrated people’s lives with the candidness and pliability of computers to work ease shows security breaches. Thus, malware detection methods perform modifications in running the malware based on behavioral and content factors. The factors are taken into consideration compromises of convergence rate and speed. This research paper proposed a method called fisher exact Boschloo and polynomial vector learning (FEB-PVL) to perform both content and behavioral-based malware detection with early convergence to speed up the process. First, the input dataset is provided as input then fisher exact Boschloo’s test Bernoulli feature extraction model is applied to obtain independent observations of two binary variables. Next, the extracted network features form input to polynomial regression support vector learning to different malware classes from benign classes. The proposed method validates the results with respect to the malware and the benign files. The present research aimed to develop the behaviors to detect the accuracy process of the features that have minimum time speeds the overall performances. The proposed FEB-PVL increases the true positive rate and reduces the false positive rate and hence increasing the precision rate using FEB-PVL by 7% compared to existing approaches.

An ensemble deep learning classifier stacked with fuzzy ARTMAP for malware detection

Malicious software, or malware, has posed serious and evolving security threats to Internet users. Many anti-malware software packages and tools have been developed to protect legitimate users from these threats. However, legacy anti-malware methods are confronted with millions of potential malicious programs. To combat these threats, intelligent anti-malware systems utilizing machine learning (ML) models are useful. However, most ML models have limitations in performance since the training depth is usually limited. The emergence of Deep Learning (DL) models allow more training possibilities and improvement in performance. DL models often use gradient descent optimization, i.e., the Back-Propagation (BP) algorithm; therefore, their training and optimization procedures suffer from local sub-optimal solutions. In addition, DL-based malware detection methods often entail single classifiers. Ensemble learning overcomes the shortcomings of individual techniques by consolidating their strengths to improve the performance. In this paper, we propose an ensemble DL classifier stacked with the Fuzzy ARTMAP (FAM) model for malware detection. The stacked ensemble method uses several heterogeneous deep neural networks as the base learners. During the training and optimization process, these base learners adopt a hybrid BP and Particle Swarm Optimization algorithm to combine both local and global optimization capabilities for identifying optimal features and improving the classification performance. FAM is selected as a meta-learner to effectively train and combine the outputs of the base learners and achieve robust and accurate classification. A series of empirical studies with different benchmark data sets is conducted. The results ascertain that the proposed ensemble method is effective and efficient, outperforming many other compared methods.

Dynamic Malware Analysis Based on API Sequence Semantic Fusion

The existing dynamic malware detection methods based on API call sequences ignore the semantic information of functions. Simply mapping API to numerical values does not reflect whether a function has performed a query or modification operation, whether it is related to network communication, the file system, or other factors. Additionally, the detection performance is limited when the size of the API call sequence is too large. To address this issue, we propose Mal-ASSF, a novel malware detection model that fuses the semantic and sequence features of the API calls. The API2Vec embedding method is used to obtain the dimensionality reduction representation of the API function. To capture the behavioral features of sequential segments, Balts is used to extract the features. To leverage the implicit semantic information of the API functions, the operation and the type of resource operated by the API functions are extracted. These semantic and sequential features are then fused and processed by the attention-related modules. In comparison with the existing methods, Mal-ASSF boasts superior capabilities in terms of semantic representation and recognition of critical sequences within API call sequences. According to the evaluation with a dataset of malware families, the experimental results show that Mal-ASSF outperforms existing solutions by 3% to 5% in detection accuracy.

Analysis of Traffic Using the Snort Tool for the Detection of Malware Traffic

The increasing prevalence of malware threats necessitates the development of robust methods for detecting and mitigating malicious network traffic. This paper presents an analysis of traffic using the Snort tool for the detection of malware traffic. The study focuses on understanding traffic patterns, evaluating Snort's performance, and comparing it with other tools or methods for malware detection. The methodology involves data collection, preprocessing, Snort configuration, and traffic analysis. The results reveal valuable insights into traffic patterns associated with malware activities, demonstrate Snort's effectiveness in detecting known malware signatures, and assess its efficiency and scalability. The comparison with other tools provides a comprehensive understanding of Snort's strengths and limitations. This research contributes to the field of network security by providing practical insights for network administrators and suggesting future research directions.

Detecting Intruders in Network using Machine Learning

Malware detection plays a crucial role in cyber-security with the increase in malware growth and advancements in cyber-attacks. Malicious software applications, or malware, are the primary source of many security problems. These intentionally manipulative malicious applications intend to perform unauthorized activities on behalf of their originators on the host machines for various reasons such as stealing advanced technologies and intellectual properties, governmental acts of revenge, and tampering sensitive information, to name a few. Malware detection methods rely on signature databases, including malicious instruction patterns in today's practice. The signature databases are used for matching against a signature generated from a newly encountered executable. Nevertheless, more efficient mitigation methods are needed due to the fast expansion of malicious software on the Internet and their self- modifying abilities, as in polymorphic and metamorphic malware. In this work, it detects Network Intrusion anomalies by using NSL-KDD dataset. The user enters the hacking parameters in the front end. The model predicts the type of attack and gives information about the type of attack to the user. The project is fully responsive and completely based on session and cookies (Client-server protocol). Then we activated our malware security device which forms production for the set of attack. This will help many cyber threads

AIM: An Android Interpretable Malware detector based on application class modeling

Smartphones are one of the IoT gadgets that have revolutionized our lives. Perhaps the most significant threat that endangers the security of smartphones is mobile malware. Despite the recent efforts to combat smartphone malware, it remains one of the significant challenges in smartphone security. Modern smartphone malware is complex and growing at a rapid pace. Thus, techniques based on machine learning have gained significant popularity in recent years. However, most of the existing methods fail to provide enough interpretability regarding their decisions. In other words, if an application is classified as malicious, it is not clear which part of the application is performing the malicious behavior. In this work, we address this gap by presenting an Android Interpretable Malware detection method (AIM) based on application class modeling. AIM utilizes hybrid analysis and a neural network classifier to distinguish malware from benign applications. Furthermore, AIM identifies malicious parts of malware applications by utilizing a novel class modeling approach based on used APIs and employing the attention mechanism. We implement AIM and evaluate its performance on up-to-date benchmark datasets. We also compare the results obtained by the proposed technique with others and investigate the impact of several feature sets on it. The results indicate that AIM outperforms most of the existing methods with an accuracy of more than 98.9% and correctly highlights malicious code snippets inside applications.

Image-Based Malware Classification Method with the AlexNet Convolutional Neural Network Model

In recent years, malware has experienced explosive growth and has become one of the most severe security threats. However, feature engineering easily restricts the traditional machine learning methods-based malware classification and is hard to deal with massive malware. At the same time, the dynamic analysis methods have the problems of complex operation and high cost, which are not suitable for efficiently classifying large quantities of malware. Therefore, we propose a novel static malware detection method based on this study’s AlexNet convolutional neural network (CNN). Unlike existing solutions, we convert all malware bytes into color images, propose an improved AlexNet architecture, and solve the unbalanced datasets with the data enhancement method. Extensive experiments are performed using the Microsoft malware dataset and the Google Code Jam (GCJ) dataset. The experimental results show that the accuracy of the Microsoft malware dataset reaches 99.99%, and the GCJ dataset reaches 99.38%. We also verify that our method can better extract the texture features of malware and improve the accuracy and detection efficiency.

BejaGNN: behavior-based Java malware detection via graph neural network.

As a popular platform-independent language, Java is widely used in enterprise applications. In the past few years, language vulnerabilities exploited by Java malware have become increasingly prevalent, which cause threats for multi-platform. Security researchers continuously propose various approaches for fighting against Java malware programs. The low code path coverage and poor execution efficiency of dynamic analysis limit the large-scale application of dynamic Java malware detection methods. Therefore, researchers turn to extracting abundant static features to implement efficient malware detection. In this paper, we explore the direction of capturing malware semantic information by using graph learning algorithms and present BejaGNN (Behavior-based Java malware detection via Graph Neural Network), a novel behavior-based Java malware detection method using static analysis, word embedding technique, and graph neural network. Specifically, BejaGNN leverages static analysis techniques to extract ICFGs (Inter-procedural Control Flow Graph) from Java program files and then prunes these ICFGs to remove noisy instructions. Then, word embedding techniques are adopted to learn semantic representations for Java bytecode instructions. Finally, BejaGNN builds a graph neural network classifier to determine the maliciousness of Java programs. Experimental results on a public Java bytecode benchmark demonstrate that BejaGNN achieves high F1 98.8% and is superior to existing Java malware detection approaches, which verifies the promise of graph neural network in Java malware detection.

Separating Malicious from Benign Software Using Deep Learning Algorithm

The increased usage of the Internet raises cyber security attacks in digital environments. One of the largest threats that initiate cyber attacks is malicious software known as malware. Automatic creation of malware as well as obfuscation and packing techniques make the malicious detection processes a very challenging task. The obfuscation techniques allow malware variants to bypass most of the leading literature malware detection methods. In this paper, a more effective malware detection system is proposed. The goal of the study is to detect traditional as well as new and complex malware variants. The proposed approach consists of three modules. Initially, the malware samples are collected and analyzed by using dynamic malware analysis tools, and execution traces are collected. Then, the collected system calls are used to create malware behaviors as well as features. Finally, a proposed deep learning methodology is used to effectively separate malware from benign samples. The deep learning methodology consists of one input layer, three hidden layers, and an output layer. In hidden layers, 500, 64, and 32 fully connected neurons are used in the first, second, and third hidden layers, respectively. To keep the model simple as well as obtain optimal solutions, we have selected three hidden layers in which neurons are decreasing in the following subsequent layers. To increase the model performance and use more important features, various activation functions are used. The test results show that the proposed system can effectively detect the malware with more than 99% DR, f-measure, and 99.80 accuracy, which is substantially high when compared with other methods. The proposed system can recognize new malware variants that could not be detected with signature, heuristic, and some behavior-based detection techniques. Further, the proposed system has performed better than the well-known methods that are mentioned in the literature based on the DR, precision, recall, f-measure, and accuracy metrics.

Development of a deep stacked ensemble with process based volatile memory forensics for platform independent malware detection and classification

Malware has become more complicated in its purpose and abilities over time, demanding continuous progress in detection and defense technologies. Malware designers use anti-analysis obfuscation techniques, including packing and encryption, to evade detection and hinder the analysis process. Current malware detection methods have shortcomings; thus, an alternative dynamic platform-independent scheme is proposed to extract harmful hardware impressions. This scheme includes extracting and converting a file from process memory dumps into an image. A combined structural and statistical image textural analysis is performed by designing a hybrid local and global feature descriptor. The hybrid feature descriptor helps to improve the data training ability of the proposed deep-stacked ensemble model by reducing input dimensions. A deep-stacked ensemble model is developed by combining prediction outputs from weak learners (CNNs) and feeding them into a meta-learner (MLP) as learning input. An explainable artificial intelligence-based approach is employed to interpret and validate the final results of the proposed scheme. Evaluations are conducted using three datasets: the publicly available Dumpware10 dataset, which contains 3686 samples from 10 different malware families; the publicly available CIC-MalMem-2022 dataset, which includes 2,916 samples from 15 different obfuscated malware families; and a real-world dataset, which contains 2375 samples of both malware and benign android apps. Experimental outcomes show that the proposed scheme achieved 99.1 % accuracy in analyzing Windows malware memory dumps, 94.3 % accuracy in analyzing Android malware memory dumps, and 99.8 % accuracy in analyzing Windows obfuscated malware memory dumps. The final results indicate that our vision-based system provides an excellent defense against malicious programs.

GooseBt: A programmable malware detection framework based on process, file, registry, and COM monitoring

As the networks is becoming faster and more convenient, computers is communicating with each other more and more frequent. However, security of computer communication is required to be concerned. Thus, this paper introduces a new programmable malware detection framework under Windows platform named GooseBt based on process, file, registry, and COM monitoring, which provides a new thought to perform malware detection. Usually, it is quite difficult to design with various kernel drivers on different platform versions, which are required to be developed before malware detection methods could be addressed. Moreover, most kinds of the existing anti-virus software are not programmable. In GooseBt framework, users can directly use easy codes to design their malware detection methods and make it run in Windows kernel mode. Static rules and dynamic rules are provided as interfaces based on message mapping. Moreover, third-party anti-virus manufacturers can directly call the API of the framework. The framework is proved to be effective and stable.

Transfer Learning for Image-Based Malware Detection for IoT

The tremendous growth in online activity and the Internet of Things (IoT) led to an increase in cyberattacks. Malware infiltrated at least one device in almost every household. Various malware detection methods that use shallow or deep IoT techniques were discovered in recent years. Deep learning models with a visualization method are the most commonly and popularly used strategy in most works. This method has the benefit of automatically extracting features, requiring less technical expertise, and using fewer resources during data processing. Training deep learning models that generalize effectively without overfitting is not feasible or appropriate with large datasets and complex architectures. In this paper, a novel ensemble model, Stacked Ensemble-autoencoder, GRU, and MLP or SE-AGM, composed of three light-weight neural network models-autoencoder, GRU, and MLP-that is trained on the 25 essential and encoded extracted features of the benchmark MalImg dataset for classification was proposed. The GRU model was tested for its suitability in malware detection due to its lesser usage in this domain. The proposed model used a concise set of malware features for training and classifying the malware classes, which reduced the time and resource consumption in comparison to other existing models. The novelty lies in the stacked ensemble method where the output of one intermediate model works as input for the next model, thereby refining the features as compared to the general notion of an ensemble approach. Inspiration was drawn from earlier image-based malware detection works and transfer learning ideas. To extract features from the MalImg dataset, a CNN-based transfer learning model that was trained from scratch on domain data was used. Data augmentation was an important step in the image processing stage to investigate its effect on classifying grayscale malware images in the MalImg dataset. SE-AGM outperformed existing approaches on the benchmark MalImg dataset with an average accuracy of 99.43%, demonstrating that our method was on par with or even surpassed them.

A New Framework for Visual Classification of Multi-Channel Malware Based on Transfer Learning

With the continuous development and popularization of the Internet, there has been an increasing number of network security problems appearing. Among them, the rapid growth in the number of malware and the emergence of variants have seriously affected the security of the Internet. Traditional malware detection methods require heavy feature engineering, which seriously affects the efficiency of detection. Existing deep-learning-based malware detection methods have problems such as poor generalization ability and long training time. Therefore, we propose a malware classification method based on transfer learning for multi-channel image vision features and ResNet convolutional neural networks. Firstly, the features of malware samples are extracted and converted into grayscale images of three different types. Then, the grayscale image sizes are processed using the bilinear interpolation algorithm to make them uniform in size. Finally, the three grayscale images are synthesized into three-dimensional RGB images, and the RGB images processed using data enhancement are used for training and classification. For the classification model, we used the previous ImageNet dataset (>10 million) and trained all the parameters of ResNet after loading the weights. For the evaluations, an experiment was conducted using the Microsoft BIG benchmark dataset. The experimental results showed that the accuracy on the Microsoft dataset reached 99.99%. We found that our proposed method can better extract the texture features of malware, effectively improve the accuracy and detection efficiency, and outperform the compared models on all performance metrics.

MalwD&C: A Quick and Accurate Machine Learning-Based Approach for Malware Detection and Categorization

Malware, short for malicious software, is any software program designed to cause harm to a computer or computer network. Malware can take many forms, such as viruses, worms, Trojan horses, and ransomware. Because malware can cause significant damage to a computer or network, it is important to avoid its installation to prevent any potential harm. This paper proposes a machine learning-based malware detection method called MalwD&C to allow the secure installation of Programmable Executable (PE) files. The proposed method uses machine learning classifiers to analyze the PE files and classify them as benign or malware. The proposed MalwD&C scheme was evaluated on a publicly available dataset by applying several machine learning classifiers in two settings: two-class classification (malware detection) and multi-class classification (malware categorization). The results showed that the Random Forest (RF) classifier outperformed all other chosen classifiers, achieving as high as 99.56% and 97.69% accuracies in the two-class and multi-class settings, respectively. We believe that MalwD&C will be widely accepted in academia and industry due to its speed in decision making and higher accuracy.

A Hybrid Attention Network for Malware Detection Based on Multi-Feature Aligned and Fusion

With the widespread use of computers, the amount of malware has increased exponentially. Since dynamic detection is costly in both time and resources, most existing malware detection methods are based on static features. However, existing static methods mainly rely on single feature types of malware, while few pay attention to multi-feature fusion. This paper presents a novel multi-feature extraction and fusion method to effectively detect malware variants by combining binary and opcode features. We propose a stacked convolutional network to capture the temporal and discontinuity information in the function call of the binary file from malware. Additionally, we adopt the triangular attention algorithm to extract code-level features from assembly code. Additionally, these two extracted features are aligned and fused by the cross-attention, which could provide a stable feature representation. We evaluate our method on two different datasets. It achieves an accuracy of 0.9954 on the Kaggle Malware Classification dataset and an accuracy of 0.9544 on a large real-world dataset. To optimize our detection model, we conduct in-depth discussions on different feature extractors and multi-feature fusion strategies. Moreover, a visualized attention module in our model is provided to explain its superiority in the opcode feature extraction. An experimental analysis is performed against five baseline deep learning models and five state-of-the-art malware detection models, which reveals that our strategy outperforms competing approaches in all evaluation circumstances.