Deep Learning-Based Malware Detection and Classification Using Inception-ResNetv2 and DenseNet Architectures

With the steady increase in the demand for Internet of Things (IoT) devices in diverse industries, such as manufacturing, medical care, and transportation infrastructure, the production of malware tailored for Smart IoT environments is also increasing. Accordingly, various malware detection studies are being conducted to detect not only known malware but also variant malware. However, it is difficult to detect malware transformed in a way that hides malicious behavior by changing and deleting bytes or modifying the assembly code. Therefore, in this study, we propose a malware detection for static security service (Mal3S) scheme that provides a secure Smart IoT environment by accurately detecting various types of malware. Mal3S extracts bytes, opcodes, API calls, strings, and dynamic link libraries (DLLs) through static analysis and then generates five types of images. Images of various sizes are trained on a multi spatial pyramid pooling network (SPP-net) model to detect malware. When evaluating the performance of Mal3S using three malware datasets, the average detection accuracy was 98.02% and the classification accuracy was 98.43%, showing better performance than existing malware detection techniques. In addition, Mal3S has demonstrated effective generalization capabilities for various types of malware.

Software has been the essential element to computers in today's digital era. Unfortunately, it has experienced challenges from various types of malware, which are designed for sabotage, criminal money-making, and information theft. To protect the gadgets from malware, numerous malware detection algorithms have been proposed. In the olden days there were shallow learning algorithms, and in recent years there are deep learning algorithms. With the availability of big data for training of model and affordable and high-performance computing services, deep learning has demonstrated its superiority in many smart city applications, in terms of accuracy, error rate, etc. This chapter intends to conduct a systematic review on the latest development of deep learning algorithms for malware detection. Some future research directions are suggested for further exploration.

Malware Detection and Analysis play a primary role in information access points such as workstations, servers, cloud storage, and mobile devices. Securing information from malware is a challenging task, and existing anti-malware applications suffer from detecting new types of attacks. In recent years, machine learning-based malware detection techniques have been applied for effective malware detection and analysis for existing and new types of malware with few drawbacks such as misclassification and increased complexity. To overcome this, the chapter focuses on adopting deep learning (DL) models to build an anti-malware application via modern Artificial Intelligence (AI) techniques. Quantum Machine Learning (QML) is a research area that explores the interplay of ideas from quantum computing and machine learning. The proposed framework is built with various DeepNet Models to improve predicted accuracy, which can carry out universal quantum computations. QML performs the information processing with quantum computers relies on substantially different laws of physics called quantum theory. Initially, executable files will be converted to binary files and forwarded to DeepNet Models to multi-classify the novel variants of malware. A comprehensive survey is carried out on the implementation of ML/DL models for malware detection and analysis by considering various factors.

Recent advances in Internet of Things (IoT) technologies require a new type of IoT security environment. Various heterogeneous smart devices have easy access to IoT environment, and as the number of users increases, they are exposed to various threats such as malicious attacks on IoT devices and IoT infrastructure, and data tampering by malicious code. Malware detection in IoT requires data and models for continuous and changing learning of smart devices. Methods/Statistical analysis: To minimize these security threats, various malware detection techniques in the field of IoT security have been studied. Malware detection in IoT environment is important for data derivation and learning model required for continuous and changing learning of smart devices. The metadata of malware detection can be normalized by the value of device id, time, behavior, location and state. This paper proposes behavior-based malware detection using deep learning (BMD-DL). Findings: BMD-DL was able to collect metadata about behavior-based malicious behavior and learn and detect malicious codes through deep learning. In addition, through the learned model, IoT Security is provided by disconnecting malicious devices that cause malicious behavior in the IoT environment. Improvements/Applications: BMD-DL collects behavioral data generated from multiple devices in the IoT and applies the results learned through deep learning to detect persistent malware.

The Internet of Things (IoT) enable the IoT to sense and respond using the power of computing to autonomously come up with the best solutions for any industry today. However, Internet of Things have vulnerabilities since it can be hacked by cybercriminals. The cybercriminals know where the IoT vulnerabilities are, such as unsecured update mechanisms and malware (Malicious Software) to attack the IoT devices. The recently posted IoT-23 dataset based on several IoT devices such as Philips Hue, Amazon Echo devices and Somfy door lock were used for machine learning classification algorithms and data mining techniques with training and testing for predictive modelling of a variety of malware attacks like Distributed Denial of Service (DDoS), Command and Control (C&C) and various IoT botnets like Mirai and Okiru. This paper aims to develop predictive modeling that will predict malicious software to protect IoT and reduce vulnerabilities by using machine learning and data mining techniques. We collected, analyzed and processed benign and several of malicious software in IoT network traffic. Malware prediction is crucial in maintaining IoT devices’ safety and security from cybercriminals’ activities. Furthermore, the Principal Component Analysis (PCA) method was applied to determine the important features of IoT-23. In addition, this study compared with previous studies that used the IoT-23 dataset in terms of accuracy rate and other metrics. Experiments show that Random Forest (RF) classifier achieved the predictive model produced classification accuracy 0.9714% as well as predict 8754 samples with various types of malware and obtained 0.9644% of Area Under Curve (AUC) which outperforms several bassline machine learning classification models.

Today, in the field of malware detection, the expanding limitations of traditional detection methods and the increasing accuracy of detection methods designed on the basis of artificial intelligence algorithms are driving research findings in this area in favour of the latter. Therefore, we propose a novel malware detection model in this paper. This model combines a grey-scale image representation of malware with an autoencoder network in a deep learning model, analyses the feasibility of the grey-scale image approach of malware based on the reconstruction error of the autoencoder, and uses the dimensionality reduction features of the autoencoder to achieve the classification of malware from benign software. The proposed detection model achieved an accuracy of 96% and a stable F-score of about 96% by using the Android-side dataset we collected, which outperformed some traditional machine learning detection algorithms.

A program or collection of instructions designed to exploit the flaws in other applications is known as an exploit. Exploit development is identifying vulnerabilities in apps and software and determining how to gain control of a system; thus, exploit development is critical for the security of digital assets and sensitive data stored on computer systems. Many flaws require an attacker to launch a series of shady actions to set up an exploit. Most of the vulnerabilities occur due to faults in software or system architecture. Attackers write code to exploit these holes to infect the machine with various types of malware which is often built on the collection of exploits and can easily be hidden in plain view of different websites. The hidden code on a website may instantly identify the operating system and programs that are running on a user’s machine, as well as the user’s browser type, and check for any vulnerabilities. In today’s world, the internet is the major cause of spreading many malware, viruses, and embedded scripts. Hence our problem statement will revolve around the detection of malicious and benign URLs and thus testing them to get the type of vulnerability.

Like the personal computer, the mobile smartphone is susceptible to various types of malware. Throughout this chapter, I will refer to malware and spyware collectively as malware. Even though I do this, it is essential to know the difference between each of these types of hostile applications.KeywordsUnited Arab EmirateGovernment SanctionUseless DataDevice OwnerFake MessageThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Malicious software (ransom ware) cyber attacks in frequency and severity, posing an increasingly serious threat to computer systems everywhere. Malware detection is a hot study area as several multiple computers, organisations, and governments have been affected by an exponential rise in malware attacks. Dynamic and static assessment of malicious characteristics and behaviour patterns is time expensive and useless in real-time malware detection, according to current technologies. It is becoming increasingly common for malicious apps to use polymorphic and adaptive techniques to rapidly modify their behaviour and develop a number of new malicious apps. In order to undertake an effective malware analysis, machine learning techniques (MLAs) are increasingly being used to create new malware varieties. This approach is time-consuming since it requires considerable feature engineering, learning and representation of features. Moreover the feature extraction process could be effectively eliminated by using advanced MLAs like deep learning. These methods have been shown to perform better with a biased training dataset, which restricts their practical application in real-time scenarios. A new improved approach for successful zero-day malware detection must be developed in order to eliminate biases and analyze these approaches autonomously.

The attack that occurred recently involved the utilization of malicious software, commonly referred to as malware, along with advanced techniques such as machine learning, specifically deep learning, code transformation, and polymorphism. This makes it harder for cyber experts to detect malware using traditional analysis methods. In view of the low accuracy and high false positive rate of traditional malware detection methods, this research proposes a fine-tuned deep learning model with a novel dataset that is compared with ANN, Support Vector Machine (SVM), random forest (RF), K-Nearest Neighbourhood (KNN) classifiers. Converting a malware code into an image could allow users to effectively identify the presence of malware, even if the original code is modified by the creator. This is due to the fact that the attributes of images remain unchanged, allowing for reliable identification. So, researchers used deep learning technology to detect malware, like detecting malaria from red blood cells. The deep learning model found that a more detailed analysis of malware data sets, focusing on RGB and greyscale images, is needed. These data sets currently rely on publicly available data, but the accuracy of the traditional model could be a lot higher. It also produces many false positive results. The main goal is to create a new data set and model using malware images to identify and categorize malware using deep learning without relying on existing image detection and transfer learning models. The researcher adjusted different hyper parameters, like the number of neurons, filters, stride, hidden units, layers, learning rate, batch size, activation function, optimizer, and epochs. Identifying and correcting issues in models, improving their clarity, stability, and fairness, as well as debugging and monitoring them, is a challenging task. To eliminate this obstacle, assess the model's behaviour and performance by employing various methods such as logging, profiling, testing, visualization, and model clarity. To overcome the challenges posed by the electricity shutdown, we utilized Google's cloud-based GPU and Python 3.7 language to conduct the experiment and train the model. Kali Linux is an operating system that can automatically encrypt file systems and has a lower chance of crashing the system due to malware in a virtual sandbox. The researcher used techniques like early stopping and cross-validation to prevent over fitting and assess generalization in addition to monitoring and evaluating the model's behaviour and performance. The researcher used different methods like L1 and L2 regularization, dropout, and batch normalization to improve the model's performance and avoid over fitting. The binary portable executable (PE) malware dataset is collected from Kaggle, Malimg, Virusshare, Malvis, MS Big2015, and VX-underground and finally converted to greyscale and RGB images to create a novel dataset to fill the lack of image dataset. The raw dataset was then rescaled to a 128x128 greyscale and RGB (red, green, blue) image and flattened to 1024-byte vector images input into convolution neural network (CNN) interpolation to extract features for malware detection. The newly acquired dataset is utilized as an input for the innovative DL algorithms in order to create a tailor-made model capable of accurately predicting malware. The findings in this customized CNN model by fine-tuning hyper-parameters with the three-channel RGB dataset outperformed a greyscale dataset with an accuracy of 98.7% and error rate of 1.3% in current malware compared with other artificial neural network (ANN), ML algorithms such as Support Vector Machine (SVM), K-Nearest Neighbour (KNN), and also Random Forest (RF) models. The proposed approach is compatible with all operating systems (Windows, Linux, and Mac) and can identify different types of malwares, such as packed, polymorphic, obfuscated, metamorphic, or variations of a malware family. There are some limitations to the shortage of malware image datasets and computational costs for fine-tuning hyper parameters in the whole model. Furthermore, the proposed approach detects malware and groups it into families without using common techniques like disassembly, decompilation, de-obfuscation, or running malicious code in a virtual environment.

The most common defenses against malware threats involves the use of signatures derived from instances of known malware. However, the constant evolution of the malware threat landscape necessitates defense against unknown malware, making a signature catalog of known threats insufficient to prevent zero-day vulnerabilities from being exploited. Recent research has applied machine learning approaches to identify malware through artifacts of malicious activity as observed through dynamic behavioral analysis. We have seen that these approaches mimic common malware defenses by simply offering a method of detecting known malware. We contribute a new method of identifying software as malicious or benign through analysis of the frequency of Windows API system function calls. We show that this is a powerful technique for malware detection because it generates learning models which understand the difference between malicious and benign software, rather than producing a malware signature classifier. We contribute a method of systematically comparing machine learning models against different datasets to determine their efficacy in accurately distinguishing the difference between malicious and benign software.

Android applications often contain vulnerabilities that can be exploited by malicious software, making automated malware detection is crucial. Since software vulnerabilities can have severe repercussions, a great deal of research and development effort has been put into developing mitigation strategies. Over the past few years, a number of different approaches have been tried in an effort to lessen the danger posed by vulnerabilities in software. The proposed approach involves multiple stages, including APK recompilation, feature extraction from manifest permissions, model training, testing, and performance analysis. The process begins with APK recompilation, where Android package files are decompiled using specialized tools to extract critical components such as manifest.xml, which contains permissions requested by the application. These permissions serve as key indicators of potential malicious intent. The extracted XML-based permissions and additional metadata are then transformed into structured feature vectors. Feature selection techniques are applied to retain the most relevant attributes, reducing noise and enhancing classification accuracy. The core classification module leverages Recurrent Neural Networks (RNNs) to analyze the extracted features and identify malicious patterns. The model undergoes supervised training using a labeled dataset comprising both benign and malicious APKs. During training, the RNN learns temporal dependencies and feature interactions, improving its ability to detect sophisticated malware. Once trained, the model is tested on a separate dataset to evaluate its classification performance. Various evaluation metrics such as accuracy, precision, recall, and F1-score are used to measure effectiveness. Finally the proposed model is compared with traditional machine learning classifiers and existing deep learning techniques. The results demonstrate that RNN-based classification significantly enhances malware detection accuracy due to its ability to process sequential patterns within application permissions. This research contributes to the field of Android security by presenting an efficient, scalable, and automated malware detection framework, leveraging deep learning for real-time classification of malicious applications.

People around the world suffer from a wide range of illnesses. The most dangerous of them all is cancer. Of all the cancers, skin cancer is the one that is spreading the fastest. The reason for this is because skin cells grow abnormally. Skin cancer is spreading around the world in part due to an increase in UV light on Earth's surface. The two most prevalent kinds of skin cancer are benign and malignant. Despite undergoing costly and time-consuming therapies, skin cancer mortality rates do not decrease. Early identification of skin cancer in its early stages is useful in lowering the death rate. Deep learning is being utilized in the modern world to identify illnesses. Convolutional neural networks (CNNs) improve the accuracy of image classification in the detection of skin cancer. This study compares the operational procedures of several CNN models in order to identify which produces the best outcomes. CNN models are analyzed using pre-trained models such as VGG16, Res-Net50, and Inception Resnet V2. Due to differences in their layer numbers, these models operate in distinct ways. Certain models function better than others, depending on their layers and how they operate. A Kaggle picture dataset containing both benign and cancerous data has been extracted. There are 3287 photos of benign and malignant skin cancer in this dataset. We have obtained accurate results for VGG16 (85%), ResNet50 (69%), and Inception Resnet V2 (83%), using various techniques. This study compares these results according to the model's operation. We compare precision, working process, and model layer numbers.

Malicious software also known as "Malware" is software that uses legitimate instructions or code to perform malicious actions. Malware poses a major threat for computer security and information security in general. Over the years, malware has evolved to the point that a single malware specimen can have hundreds or maybe thousands of variants using polymorphic and metamorphic transformation to change the signature of the malware variant in propagation. The common signature-based malware detection methods are no longer robust to detect these variants due to the alteration of code. Static analysis is required to obtain these signatures and anti-virus companies are required to propagate these signature updates to their software. A faster detection method is needed to compensate the exponentially increasing number of malware variants. Machine learning is a trending approach for malware detection. This removes the need to use signature-based detection and is also faster. Software companies do not need to propagate signatures as often. Machine learning algorithms using opcode sequences can recognise patterns in the malicious code that are not present in common signatures and classify them more efficiently. Therefore, a machine learning approach for malware detection should be adopted for faster and more efficient detection. Most research in malware detection using machine learning used static attributes such as network connections, processes spawned, hashes, etc., that were not that robust to changes. In this paper we introduced our novel approach in using trigrams and PE file attributes as features for malware detection. We took a text mining approach to make our detection method more robust to polymorphism and metamorphism. The instruction sequence for critical code in malware on the assembly level is basically the same across malware families. We used opcode trigram sequences as the main feature for our machine learning algorithm. We used Support Vector Machine(SVM) as our classifying algorithm which is a discriminative classifier model that gives a definite decision whether the predicted outcome belongs to the learned class or not. The above shows our novel approach that enabled us to get higher detection rates with less features.

Recent advancements in computer technology have precipitated a shift towards virtual environments, accelerated by the COVID-19 pandemic. Cybercriminals have capitalized on this trend, transitioning their activities to exploit vulnerabilities in cyberspace. Malicious software (malware) has emerged as a preferred tool for launching cyber-attacks, continually evolving with sophisticated obfuscation and packing techniques to evade detection. Traditional machine learning (ML) algorithms, once effective in identifying malware, are now struggling to keep pace with these advancements. In response, deep learning (DL) algorithms offer a promising solution, leveraging their ability to discern intricate patterns and correlations within data. This study proposes a novel hybrid deep-learning-based architecture, integrating two pre-trained network models to enhance classification accuracy. Through extensive evaluation on datasets including Malimg, Microsoft BIG 2015, and Malevis, the proposed method demonstrates significant improvements in accuracy, outperforming existing ML-based malware detection methods in the literature. Specifically, the proposed method achieves an impressive accuracy of 97.78% on the Malimg dataset, underscoring its effectiveness in combating sophisticated malware variants. Keywords — Malware, malware classification, malware detection, malware variants, deep neural networks, transfer learning, deep learning.