HybriDroid: an empirical analysis on effective malware detection model developed using ensemble methods

In this paper, we present a novel methodology that addresses some of these weaknesses. Our goal is to provide mobile users with an effective malware detection and mitigation solution keeping in view the limited resources of mobile devices and versatility of malware behavior. We are leveraging the resource rich cloud platform for carrying out the processing on the replicas of mobile devices. Our detection engine analyses the apps against certain distinguishing combination of permissions and intents used by target apps. Different machine learning algorithms were tested for best classification results on the data set of real world benign and malware apps. Naive Bayesian outperformed most of the tested algorithms and therefore it was selected for our detection engine on its performance. This work is first of its kind which is leveraging the cloud computing and machine learning algorithms to investigate the combined effects of permissions and intents for effectively distinguishing between the malware and benign apps. Performance of proposed approach has been validated by applying the technique to the available malicious and benign samples collected from different sources. The contributions of this study are as follows:  Permissions and intents amalgamation. We combine the two vital security mechanisms of android apps for malware detection. 

Defending malware detection models against evasion based adversarial attacks

The Internet of Things (IoT) has become a technological innovation that brings many benefits in various sectors, but also presents challenges, especially in terms of cybersecurity. One of the main threats is malware, which can damage devices, steal data, and disrupt system performance. With the increasing use of IoT, malware attacks on IoT devices are a serious concern. Previous research shows that malware detection models in IoT devices still have shortcomings, especially in terms of accuracy. One of the algorithms used in malware detection, Naïve Bayes, has been shown to provide low accuracy results. This study aims to improve the accuracy of malware detection on IoT networks by applying Ensemble learning techniques using traffic data from the IoT-23 dataset. The methodology used refers to the CRISP-DM (Cross Industry Standard Process for Data Mining) framework, which includes the stages of domain understanding, data understanding, data preparation, modelling, evaluation, and deployment. The results show that Ensemble learning improved the performance of individual models. Naïve Bayes as a single model produces an accuracy of 0.24, increasing to 0.35 when combined with AdaBoost, and 0.99 when combined with XGBoost. The combination of the three models also produced an accuracy of 0.99. These results demonstrate the effectiveness of ensemble learning in improving malware detection accuracy in IoT environments.

The last five years have shown a tremendous increase in the number of Android smartphone users. So has been the case with malicious Android applications that aim to jeopardize user data, security, and privacy. Most existing Android malware detection engines find it challenging to keep up with the pace of incoming malware and their sophistication of evasion techniques against the detection engines. This has prompted researchers to delve into using machine learning and deep learning algorithms to construct state-of-the-art malware detection models. However, research indicates that these detection models might be vulnerable to adversarial attacks prompting a thorough investigation. Therefore, we first propose a image based malware detection pipeline that uses an embedding layer-based hybrid CNN named E-CNN that uses Android permissions and intents as features for malware detection. The permission and intent based E-CNN detection models achieved baseline accuracy of \(93.48\%\) and \(76.7\%\) respectively. We then act as an adversary and propose the ECO-FGSM adversarial evasion attack against the above detection models. The ECO-FGSM attack converts malware samples into adversarial malware samples so that they are forcefully misclassified as benign by the detection models. The proposed attack achieved a high fooling rate of \(55.72\%\) and \(99.97\%\) against permission and intent based E-CNN detection models, respectively. We also identified a list of most vulnerable permissions and intents to generate adversarial samples. We then use adversarial retraining as a defense strategy to counter the ECO-FGSM attack against the detection models. The adversarial defense helped improve the baseline accuracies of permission and intent based E-CNN detection models by \(3.41\%\) and \(11.4\%\), respectively. We re-attack the adversarially retrained models using the ECO-FGSM attack to validate their adversarial robustness. We found a reduction in the fooling rate by \(23.28\%\) and \(97.55\%\) against permission and intent-based E-CNN detection models, respectively. Finally, we conclude that investigating the adversarial robustness of the malware detection models is an essential step that helps improve their performance and robustness before real-world deployment. KeywordsAndroidAdversarial robustnessConvolutional Neural NetworkEvasion attackMalware detection

In recent years, the increasing number of malicious software has led to more and more serious security threats to computers or network. The researches have been devoting significant efforts to solve the numerous challenges in malware detection and a large amount of literature available which worthies deeply analyzing and sorting out to offer guidance for the developmental research on malicious code detection. In this paper, the visualized tool of CiteSpace is used to assess the current state and explore the trends of malware research based on the bibliographic records retrieved from the China National Knowledge Internet. We analyze the malware research in a scientific and systematic way and display the research status and possible development trend in this field concisely and intuitively, which provide the theoretical basis for the in-depth study of malware detection for the scientific research. Finally, the malware detection model is designed according to the analysis results of Mapping Knowledge Domain to achieve effective and efficient performance in malware detection.

SummaryTo deal with the huge amount of data, minimizing the overhead will play a key role in speedy and efficient malware detection. We propose a machine learning (ML) malware detection model with preprocessing to limit the feature overhead. The portable‐executable (PE) header information that retains meaningful and distinctive information has been considered to classify benign and malware files. The dataset is preprocessed by applying transformation, outlier detection and filling, and smoothing techniques. A maximum relevance minimum redundancy‐based feature selection method is deployed to assign the rank and score to each feature retaining the maximum relevant and minimal redundant information. Based on the obtained rank, many subsets of features have been created and investigated against support vector machine (SVM) and k‐nearest neighbors (k‐NN) with parametric tuning. The proposed ML model integrated with data preprocessing, feature selection, and SVM‐polynomial classifier has superior performance. This model is eliminating 63.8% feature overhead with accuracy above 99.1% for the benchmark datasets. To examine the robustness of the proposed model, new balanced and imbalanced datasets are created using new malware. The test results are encouraging with accuracy and specificity above 96.68%, 97.65%, and 91.57%, respectively. Interestingly, the proposed model is not trained using the newly created dataset.

Today, in the field of malware detection, the expanding limitations of traditional detection methods and the increasing accuracy of detection methods designed on the basis of artificial intelligence algorithms are driving research findings in this area in favour of the latter. Therefore, we propose a novel malware detection model in this paper. This model combines a grey-scale image representation of malware with an autoencoder network in a deep learning model, analyses the feasibility of the grey-scale image approach of malware based on the reconstruction error of the autoencoder, and uses the dimensionality reduction features of the autoencoder to achieve the classification of malware from benign software. The proposed detection model achieved an accuracy of 96% and a stable F-score of about 96% by using the Android-side dataset we collected, which outperformed some traditional machine learning detection algorithms.

Malware detection plays a critical role in securing endpoints such as workstations, servers, cloud instances, and mobile devices. It involves identifying and mitigating malicious activities triggered by various forms of malware, including viruses, trojans, worms, ransomware, adware, and spyware. With the rapid proliferation of sophisticated and evasive malware variants, such as polymorphic and metamorphic malware, traditional signature-based and heuristic approaches are no longer sufficient. These conventional methods often fail to detect previously unseen or obfuscated threats, making the adoption of more intelligent and adaptive systems essential. In response to this challenge, this project explores the application of machine learning techniques to enhance malware detection and classification. Leveraging publicly available malware datasets, various supervised and unsupervised algorithms—such as Decision Trees, Random Forests, Support Vector Machines (SVM), k-Nearest Neighbors (k-NN), Naïve Bayes, and Artificial Neural Networks (ANN)—will be employed and evaluated. Additionally, feature extraction and dimensionality reduction techniques such as Principal Component Analysis (PCA) will be applied to improve model performance. The objective is to assess and compare the models using metrics such as accuracy, precision, recall, F1-score, and confusion matrix analysis. This project aims to identify the most effective machine learning model for real-time, scalable, and accurate malware detection, contributing to improved cybersecurity practices and proactive threat mitigation. Keywords: Malware detection, machine learning, enterprise security, information gain, random forest, PE analysis, API calls.

Existing research in malware detection and classification has focused on the higher accuracy of the results. Generally, high accuracy is achieved through a large set of entropy features in most of the existing frameworks. However, detection and classification time (which also includes the feature extraction time) have largely been neglected in past studies. In this paper, we propose a neural network-based model for Windows-based malware detection and classification. We also study the impact of reducing the number of features, feature types, and feature extraction time on the accuracy of malware detection and classification. We compared our model with Gaussian Naive Bayes (gNB), Logistic Regression (LR), K-Nearest Neighbor (KNN), Classification and Regression Trees (CART), Random Forest (RF), and Extreme Gradient Boosting (XGB). Our proposed model achieves the highest accuracy of 92.17% for detection and 98.41% for classification by using only 100 features of entropy. Results demonstrate that by replacing entropy features with the GINI-index features and by adjusting feature sets, we can get 21.93% faster detection and 15.6% faster classification at the cost of less than 3% and 2% reduction in accuracy respectively.

The last decade witnessed an exponential rise of Android smartphones and malware attacks on them. Researchers have investigated and proposed many promising malware detection models based on machine learning. However, these malware detection models are susceptible to adversarial attacks which threaten the Android security ecosystem. In this article, we propose to develop malware detection models which are more robust against adversarial attacks. We first designed an i-bit adversarial attack policy which achieved an average fooling rate of 51% with maximum ten modifications across twelve different malware detection models. Later we also propose an adversarial defence mechanism which enhanced the robustness of the malware detection models by reducing the fooling rate to one-third against the same adversarial attack.

Antivirus software is one of the most widely installed software for protecting computer from malicious attacks. However, traditional host-based antivirus needs to store all viruses' pattern or sample, which not only needs large local storage, but also fails to detect modern threats in time. The newly come cloud-based antivirus, which needs no extra local storage and compares virus' pattern on provider's cloud servers, has the disadvantages of being more likely to be attacked when offline. This paper advocates P2PAV, a new model for malware detection through P2P network, which takes advantages of traditional ones and cloud antivirus, reduces local storage, and meanwhile, improves the ability of detecting modern virus than traditional ways, and combating virus when offline than cloud-based antivirus.

The threats and damages posed by malwares these days are alarming as Anti-virus vendors tend to combat the menace of malwares by the design of Anti-Virus software. This software also has tremendous impact on the performance of the computer system which in turn can become vulnerability for malware attacks. Anti-Virus (anti-malware) software is a computer program used to detects, prevents and deletes files infected by malwares from communicating devices by scanning. A virus is a malware which replicates itself by copying its code into other computer programs or software. It can perform harmful task on affected host computer such as processors time, accessing private information, corrupting and deleting files. This research carry out malware evasion and detection techniques and then focuses on the comparative performance analysis of some selected Anti-Virus software (Avast, Kaspersky, Bitdefender and Norton) using a VMware. Quick, full and custom scans and other parameters were used. Based on the analysis of the selected anti-virus software, the parameters that offers the utmost performance considering malware detection, removal rate, memory usage of the installed antivirus, and the interface launch time is considered the best.

Deep-learning-based malware-detection models are threatened by adversarial attacks. This paper designs a robust and secure convolutional neural network (CNN) for malware classification. First, three CNNs with different pooling layers, including global average pooling (GAP), global max pooling (GMP), and spatial pyramid pooling (SPP), are proposed. Second, we designed an executable adversarial attack to construct adversarial malware by changing the meaningless and unimportant segments within the Portable Executable (PE) header file. Finally, to consolidate the GMP-based CNN, a header-aware loss algorithm based on the attention mechanism is proposed to defend the executive adversarial attack. The experiments showed that the GMP-based CNN achieved better performance in malware detection than other CNNs with around 98.61% accuracy. However, all CNNs were vulnerable to the executable adversarial attack and a fast gradient-based attack with a 46.34% and 34.65% accuracy decline on average, respectively. Meanwhile, the improved header-aware CNN achieved the best performance with an evasion ratio of less than 5.0%.

GHGDroid: Global heterogeneous graph-based android malware detection

Towards an interpretable deep learning model for mobile malware detection and family identification