Integrating Static and Dynamic Malware Analysis Using Machine Learning

With the increase in the popularity of mobile devices, malicious applications targeting Android platform have greatly increased. Malware is coded so prudently that it has become very complicated to identify. The increase in the large amount of malware every day has made the manual approaches inadequate for detecting the malware. Nowadays, a new malware is characterized by sophisticated and complex obfuscation techniques. Thus, the static malware analysis alone is not enough for detecting it. However, dynamic malware analysis is appropriate to tackle evasion techniques but incapable to investigate all the execution paths and also it is very time consuming. So, for better detection and classification of Android malware, we propose a hybrid approach which integrates the features obtained after performing static and dynamic malware analysis. This approach tackles the problem of analyzing, detecting and classifying the Android malware in a more efficient manner. In this paper, we have used a robust set of features from static and dynamic malware analysis for creating two datasets i.e. binary and multiclass (family) classification datasets. These are made publically available on GitHub and Kaggle with the aim to help researchers and anti-malware tool creators for enhancing or developing new techniques and tools for detecting and classifying Android malware. Various machine learning algorithms are employed to detect and classify malware using the features extracted after performing static and dynamic malware analysis. The experimental outcomes indicate that hybrid approach enhances the accuracy of detection and classification of Android malware as compared to the case when static and dynamic features are considered alone.

Accurate and reliable lithological mapping through satellite-borne remote sensing data and image classification approaches has a critical role since it can automatically and promptly identify lithological units over large areas. Most available Pixel-Object Based comparative classification studies have been applied to land use land cover (LULC) studies; however, this research aims to evaluate and compare the performance of these digital classification methods in the field of geological mapping in semi-arid areas, by integrating spectral bands and neo-bands, particularly the Minimum noise fraction (MNF) and the principal component analysis (PCA), of Sentinel-2A satellite imagery, to map the southern of Skhour Rehamna which is located at the western Moroccan Meseta. The analysis results from two different methods, namely, pixel-based image analysis (PBIA) with k-nearest neighbour (K-NN) and Random Forest (RF) machine learning algorithms (MLAs), and Geographic Object-Based Image Analysis (GEOBIA) were assessed and compared. PBIA method involved selection of training areas whether it was k-NN or RF MLAs, and produced lithological maps that exhibit “salt and pepper” effects as well as problems associated to delineating accurate lithological boundaries, while GEOBIA approach involved multi-resolution segmentation step where scale, shape and compactness parameters should be adjusted as accurate as possible, in order to segment the image into homogeneous and meaningful regions so that the resulted samples were classified using Standard Nearest Neighbour algorithm. Therefore, the resulting lithological maps were assessed by comparing both techniques using confusion matrix, overall accuracy (OA) and Kappa coefficient (K). The results show that the GEOBIA approach had higher overall agreement (83.46% OA and 0.76 K) than RF (81.92% OA and 0.72 K) and k-NN (80.79% OA and 0.70 K) PBIA approaches. Overall, the results clearly indicate the potential of GEOBIA technique for lithological mapping applications to produce more realistic maps.

Malware classification plays an important role in tracing the attack sources of computer security. However, existing static analysis methods are fast in classification, but they are inefficient in some malware using packing and obfuscation techniques; the dynamic analysis methods have better universality for packing and obfuscation, but they will cause excessive classification cost. To overcome these shortcomings, in this paper, we propose a classification system Malscore based on the probability scoring and machine learning, which sets the probability threshold to concatenate static analysis (called Phase 1) and dynamic analysis (called Phase 2). The convolutional neural networks with spatial pyramid pooling were used to analyze the grayscale images (static features) in Phase 1, and the variable n-grams and machine learning were used to analyze the native API call sequences (dynamic features) in Phase 2. Malscore combined static analysis with dynamic analysis not only accelerated the static analysis process by taking advantage of the CNN in image recognition but also appeared to be more resilient to obfuscation by the dynamic analysis. Different from other static and dynamic analysis techniques, when malware is detected, due to the fact that malware will most likely be labeled only by static analysis, we could reduce the overheads by dynamically analyzing a few malware that has less obvious features or greater confusion in static analysis. We performed experiments on 174607 malware samples from 63 malware families. The result showed that Malscore achieved 98.82% accuracy for malware classification. Furthermore, Malscore was compared with the method of using static and dynamic analysis. The preprocessing and test time represented a reduction of 59.58% and 61.70%, respectively.

The detection and identification of Distributed Denial-of-Service (DDoS) attacks remains a challenge in cloud/edge/fog computing environments. It usually requires network middleboxes, such as deep packet inspectors (DPI), for detection task mostly. But clouds and fogs have native powerful telemetry systems that are not yet fully exploited for DDoS detection; and provide so much information that could aid attack identification tasks as well. Machine Learning (ML) algorithms can help one diving into the richness of cloud’s native data collection services, which have a multitude of metrics from both physical and virtual hosts. This paper evaluates the use of ML algorithms over datasets collected from a experimental testbed based on OpenStack. Controlled attack scenarios were used to investigate the ability of ML for tasks such as detecting and identifying SYN_Flood and GET_Flood DDoS attacks mixed, in different proportions, with legitimate clients. kNN and Random Forest ML algorithms were trained and tested, and for evaluation the metrics accuracy, recall, precision, and F1-score were used. Our experiments presented about 87% of accuracy in the detection of SYN_Flood and GET_Flood DDoS attacks, whereas Snort IDS mostly fails to detect the latter attack by processing the corresponding packet traces. Also, the detection of PING_Flood DDoS attack was tested without training as an initial evaluation towards the generalization of the proposal.

The process of building new dataset and the existence of such a data followed the urgent need for the existence of datasets that are specialized in educational lectures, so this will need an accurate classification algorithm to classify it, the benefit of classify such dataset is to minimize the workload of classifying each file manually and individually. In the present paper, authors perform experimentations for conducting an empirical deep learning study, especially, convolutional neural network, for three new datasets of educational lectures which are (PDF, Word and PowerPoint datasets), The three new datasets using real data educational resources lectures collected from various document projects of different universities and institutions. The architecture has been applied to the task of the text classification in the domain of the document with documents data-sets have been obtained from a variety of projects on actual document cases. The aim of the present study is to initially test the performance of each dataset (PDF, Word, and PowerPoint dataset) through using four machine learning classification algorithms which are (Bayes Net, Random Forest, Random Committee, and OneR). Second goal is experimenting the efficiency of the approach of the deep learning in the tasks of classification and after that, comparing the efficiencies with the efficiencies of traditional machine learning classification methods. Mainly two classification techniques used to maximize the benefits of the classification process, the first one is to use the deep learning algorithm which shows an accuracy of classifying file between (95 and 96%) for three new dataset files and standard machine learning algorithms (OneR, Random forest, Bayes net, and Random Committee ) these algorithm shows accuracy 91% for PDF Dataset using random forest and random committee algorithms, for Word dataset the accuracy is 46% using random committee, and for the last dataset PowerPoint the accuracy is 77% using random forest, Therefore, we will choose Deep learning algorithm because it gives higher results and accuracy than machine learning algorithms.

<p>The presence of subglacial sediments is important in enabling streaming ice flow and may be a critical controlling factor in determining the onset regions of ice streams. Improving our knowledge of the location of sedimentary basins underlying large ice sheets will improve our understanding of how the substrate influences the ice streams.  Advancing our understanding of the interaction between subglacial sediments and ice flow is critical for predictions of ice sheet behavior and the consequences on future climate change. To date, no comprehensive distribution of onshore and offshore sedimentary basins over Antarctica has been developed. The goal of this project is to use a combination of large-scale datasets to characterize known basins and identify new sedimentary basins to produce a continent-wide mapping of sedimentary basins and provide improved basal parametrizations conditions that have the potential to support more realistic ice sheet models. The proposed work is divided into three main steps. In the first step, the Random Forest (RF), a supervised machine learning algorithm, is used to identify sedimentary basins in Antarctica. In the second step, a regression analyses between aerogravity data and topography is done to evaluate the gravity signal related to superficial heterogeneities (i.e. sediments) and compare the results to the depth of magnetic sources using the Werner deconvolution method. Last, the correlation between sedimentary basins and ice streams is investigated. Here, we will present the preliminary results from Step 1. The Random Forest uses ensemble learning method for classification and regression. The classification rules for this present work are based on the geophysical parameters of major known sedimentary basins. First we classify the known basins with all available geophysical compilations including topography, gravity and magnetic anomalies, sedimentary thickness, crustal thickness, geothermal heat flux, information on the geology, rocky type and bedrock geochemistry, and then use the Random Forest machine learning algorithm to classify the geology underneath the ice into consolidated rock and sediments based on these parameters.</p>

Machine learning approach in non-intrusive monitoring of tool wear evolution in massive CFRP automatic drilling processes in the aircraft industry

Os dados de sensoriamento remoto (SR) são uma fonte essencial de informação para o mapeamento da dinâmica da paisagem em áreas urbanas. Algoritmos de inteligência artificial (IA), incluindo aprendizado de máquina (AM), fornecem métodos robustos para o processamento de dados de SR. Este estudo utilizou métodos de AM do software GRASS GIS para processar imagens de satélite e analisar as mudanças na paisagem da região central da China. O objetivo foi analisar a dinâmica da paisagem por meio das mudanças na cobertura do solo detectadas ao longo de 10 anos, com intervalos de 2 anos entre as imagens. O fluxo de trabalho incluiu o algoritmo Random Forest de classificação de imagens. Os dados incluíram seis imagens Landsat 8-9 OLI/TIRS, capturadas no outono de 2013, 2015, 2017, 2019, 2021 e 2023. Os resultados indicaram a expansão da área da cidade de Wuhan, o que evidencia os processos de urbanização e desenvolvimento intensivo do solo. Este artigo demonstra a aplicação de uma abordagem aprimorada por IA em cartografia para análise de imagens, visando a análise da dinâmica da paisagem na região central da China.

Cognitive and functional decline are common problems in older adults, especially in those 75+ years old. Currently, there is no specific plasma biomarker able to predict this decline in healthy old-age people. Machine learning (ML) is a subarea of artificial intelligence (AI), which can be used to predict outcomes Aim: This study aimed to evaluate routine laboratory variables able to predict cognitive and functional impairment, using ML algorithms, in a cohort aged 75+ years, in a one-year follow-up study. One hundred and thirty-two older adults aged 75+ years were selected through a community-health public program or from long-term-care institutions. Their functional and cognitive performances were evaluated at baseline and one year later using a functional activities questionnaire, Mini-Mental State Examination, and the Brief Cognitive Screening Battery. Routine laboratory tests were performed at baseline. ML algorithms-random forest, support vector machine (SVM), and XGBoost-were applied in order to describe the best model able to predict cognitive and functional decline using routine tests as features. The random forest model showed better accuracy than other algorithms and included triglycerides, glucose, hematocrit, red cell distribution width (RDW), albumin, hemoglobin, globulin, high-density lipoprotein cholesterol (HDL-c), thyroid-stimulating hormone (TSH), creatinine, lymphocyte, erythrocyte, platelet/leucocyte (PLR), and neutrophil/leucocyte (NLR) ratios, and alanine transaminase (ALT), leukocyte, low-density lipoprotein cholesterol (LDL-c), cortisol, gamma-glutamyl transferase (GGT), and eosinophil as features to predict cognitive decline (accuracy = 0.79). For functional decline, the most important features were platelet, PLR and NLR, hemoglobin, globulin, cortisol, RDW, glucose, basophil, B12 vitamin, creatinine, GGT, ALT, aspartate transferase (AST), eosinophil, hematocrit, erythrocyte, triglycerides, HDL-c, and monocyte (accuracy = 0.92). Routine laboratory variables could be applied to predict cognitive and functional decline in oldest-old populations using ML algorithms.

With the rapid development of automation tools including polymorphic and metamorphic engines, generic packers, and genetic programming, many variants of malware have emerged, which pose a significant threat to the Internet security. To effectively detect malware variants, researchers have developed visualization-based approaches that can visualize malware adaptations for in-depth malware analysis. However, most existing visualization approaches rely on the binary image of a malware sample, which fail to provide an effective texture feature representation and thus often result in low efficiency in coping with challenging malware samples. In this paper, we propose SpecView , a malware spectrum visualization framework with singular spectrum transformation. SpecView converts malware binary code into one-dimensional time series spectrum data, and leverages the singular spectrum transformation method to obtain the structural changes preserved in the time series spectrum data. Then, we utilize the particle swarm optimization algorithm to optimize the singular spectrum transformation performance in SpecView. We apply SpecView in the task of malware classification. Extensive experimental results show that SpecView is effective and efficient in malware classification on the Malimg, Malheur, Drebin, and PRAGuard Malgenome Class Encryption datasets, with classification accuracy exceeding 99%, and it can effectively identify malware variants that use evasive techniques such as packer and encryption obfuscation. The proposed method outperforms the state-of-the-art methods on all datasets and the classification accuracy reaches 100% for 5 malware families packed by the UPX packer on the Malimg dataset, as well as 9 malware families that use Class Encryption obfuscation techniques on the PRAGuard Malgenome Class Encryption datasets.

Chronic Kidney Disease or CKD is a global concern that continues to flourish and affect the wellbeing of people and systems across the world. It is defined by the gradual loss of kidney functionality that leads to important issues like cardiovascular disease, renal failure, and increased death rates. Previous researchers has concentrated towards the development of machine learning algorithms Random Forest, K Nearest Neighbour algorithm, Decision Tree and Deep Neural Network for CKD prediction, but higher prediction accuracy and model interpretability has not been achieved. Although some researchers have attempted to shed light on Kidney Disease prediction, the prophecy of Chronic Kidney Disease remains unsolved. For this reason, the main objective of this paper is to integrating some other machine learning algorithms like XGboost along with bayesian optimization for hyper parameter tuning of xgboost and improve CKD prediction along with a large feature set and strong non-linear dependencies within the data. The research derived a dataset from a sonograph showing a hospital from Karaikudi, Tamil Nadu from India. The dataset has 400 samples where 250 samples are positive for CKD and 150 samples are negative. This approach builds upon the previous work of Arumugham et al. (2023) who achieved a remarkable accuracy of 98.75% when using a deep neural network (DNN) model. The findings of this research offer insight into the use of advanced machine learning methods for the better prediction and management of chronic kidney disease.

An accurate and efficient surrogate model plays a significant role in the optimal design of electrical motors. This paper presents an accurate and efficient surrogate modeling method for a flux reversal permanent magnet arc motor (FR-PMAM) based on machine learning algorithm. Specifically, the motor topology and the optimized design of the FR-PMAM are firstly illustrated. Then, the PM magnetic motive force-permeance model is developed to select structural parameters of FR-PMAM. After that, a finite-element analysis (FEA) model of FR-PMAM is calculated to obtain sample data. A machine learning algorithm random forest is introduced into the field of motor optimal design for the first time to evaluate the contribution of each parameter to the design objectives. Based on the sample data, an efficient machine learning algorithm CatBoost is innovatively employed to establish the accurate and efficient surrogate model of the FR-PMAM that can capture the complex function relationship between output objectives and input parameters. Subsequently, an improved genetic algorithm with the elitist reservation strategy is adopted to obtain the optimal combination of the structural parameters of FR-PMAM. Finally, a prototype of the FR-PMAM is manufactured. The FEA and experimental results validate the effectiveness of the investigated surrogate modeling method.

BackgroundAlthough high tibial osteotomy (HTO) is an established treatment option for medial compartment osteoarthritis, predictive factors for HTO treatment success remain unclear. This study aimed to identify informative variables associated with HTO treatment success and to develop and internally validate machine learning algorithms to predict which patients will achieve HTO treatment success for medial compartmental osteoarthritis.MethodsThis study retrospectively reviewed patients who underwent medial opening-wedge HTO (MOWHTO) at our center between March 2010 and December 2015. The primary outcomes were a lack of conversion to total knee arthroplasty (TKA) and achievement of a minimal clinically important difference of improvement in the Knee Injury and Osteoarthritis Outcome Score (KOOS) at a minimum of five years postoperatively. Recursive feature selection was used to identify the combination of variables from an initial pool of 25 features that optimized model performance. Five machine learning algorithms (XGBoost, multilayer perception, support vector machine, elastic-net penalized logistic regression, and random forest) were trained using five-fold cross-validation three times and applied to an independent test set of patients. The performance of the model was evaluated by the area under the receiver operating characteristic curve (AUC).ResultsA total of 231 patients were included, and 200 patients (86.6%) achieved treatment success at the mean of 9 years of follow-up. A combination of seven variables optimized algorithm performance, and the following specific cutoffs increased the likelihood of MOWHTO treatment success: body mass index (BMI) ≤ 26.8 kg/m2, preoperative KOOS for pain ≤ 46.0, preoperative KOOS for quality of life ≤ 33.0, preoperative International Knee Documentation Committee score ≤ 42.0, preoperative Short-Form 36 questionnaire (SF-36) score > 42.25, three-month postoperative hip-knee-ankle angle > 1.0°, and three-month postoperative medial proximal tibial angle (MPTA) > 91.5° and ≤ 94.7°. The random forest model demonstrated the best performance (F1 score: 0.93; AUC: 0.81) and was transformed into an online application as an educational tool to demonstrate the capabilities of machine learning.ConclusionsThe random forest machine learning algorithm best predicted MOWHTO treatment success. Patients with a lower BMI, poor clinical status, slight valgus overcorrection, and postoperative MPTA < 94.7 more frequently achieved a greater likelihood of treatment success.Level of evidenceLevel III, retrospective cohort study.

Necrotising enterocolitis (NEC) is an inflammatory intestinal disorder affecting premature infants. Despite the worldwide improvement of health care practices and facilities raising the survival rates of neonatal premature infants, there has not been any improvement in treatment options or mortality rates for NEC. There has been an extensive volume of research into NEC, though to date there has not been any evidence to directly associate a causal agent to this devastating disease, nor have there been any conclusive observations of NEC prior to birth. The only key prognostic signal for NEC is that onset and severity of the disease are significantly associated with the prematurity of the neonatal infant. During the process of birth, the infant transitions from the near sterile conditions of the womb to the outside environment teeming with bacteria. Only then does the infant develop a symbiotic relationship as a host to beneficial bacteria. Upon this transition the community of gut microbes develops and aids in a range of host functions, namely digestion and absorption of nutrients, as well as the immune response. It is also at this time that NEC can begin to develop in the lower gastrointestinal tract. This coinciding of factors implicates the colonisation of the gut with bacteria in the development of NEC, however studies to date have failed to provide consistent reports of a causative pathogen or a characteristic gut microbiome structure associated with NEC. The purpose of this study was to characterise the structure of the bacterial community in the gastrointestinal tract of infants with and without NEC in order to identify a community distinctive to infants with NEC. This was addressed using non-invasive faecal sampling of premature infants in a large, prospectively enrolled cohort from across England, sampled over a twenty-day window spanning ten days prior to and ten days following the onset of NEC. Using established V4 16S rRNA protocols, bacterial taxa within environmental samples could be characterised without relying on classic culture dependent methods. With this amplification technique it was possible to utilise small amounts of bacterial DNA isolated from infant faecal samples while at the same time mitigating the selection bias associated with culture-based techniques. Short read sequencing (illumina MiSeq) was performed on a total of 656 faecal samples from 132 infants spanning eight neonatal intensive care units across England. All infants had gestational durations of less than 35 weeks. 44 infants had NEC (225 samples) and 88 were assigned as controls (431 samples) according to key risk factors defined by medical practitioners. Taxonomic abundances assigned with the QIIME informatics pipeline were normalised using non-reductive negative binomial normalisation. Local contributions to beta-diversity (LCBD) scores were used to quantify taxonomic changes in the community structure through subset regression. Non-metric multidimensional scaling (NMDS) was used to establish risk factors that best described NEC and control samples. The Random Forest machine learning algorithm was used to establish taxa that best discriminated between NEC and control infants, as well as to identify any conserved pathogens. Subset regression identified feeding regime, mode of delivery and age at sampling as significant discriminating factors for the NEC status of infants based on sample LCBD values. However, NMDS plots of sample LCBD values showed no clear clustering of samples according to NEC status. Canonical correlation analysis (CCA) indicated that this variability was due to inter-individual differences. Of the risk factors that could be accounted for, feeding regime was the most effective in differentiating community structures of NEC and control infant samples. There was also evidence that initial communities were influenced by delivery method. Three subgroups of infants based on these influential risk factors and with sufficient sampling depth were established and analysed separately in addition to collective, population-scale analysis. Random Forest analysis demonstrated that reduced abundance of the genus Bifidobacterium was significantly associated with NEC across all sub-groups of infants. Additionally, this method of analysis indicated no clear pathogenic taxa that consistently spanned the population. For infants with NEC that were delivered by caesarean section and fed both formula and breast milk, there was increased abundance of the genus Dialister when sampled shortly after birth. Infants that did not develop NEC, who were delivered vaginally and fed both formula and breast milk were seen to have a significantly greater abundance of the genus Veillonella over time, relative to NEC subjects. There were no additional taxonomic differences that could be ascertained in the sub-group of infants who were vaginally delivered and fed breast milk exclusively. Overall, the unique nature of the microbiome and the high degree of inter-individual variation within the community made direct comparisons between NEC and non-NEC subjects difficult. However, by accounting for factors that were significantly associated with NEC status it was possible to observe consistent association of increased bifidobacterial abundance in infants that did not develop NEC. This highlights the importance of large scale studies and case-control assignment when analysing complex community structures such as that of the human gastrointestinal tract, as well as the powerful, deep analytical analysis provided by machine learning algorithms. Further work should look to establish the impact and role of Bifidobacteria in the human gut community to inform early interventions in healthcare settings for infants at risk of NEC, focussing specifically on encouraging the development of a community structure reflective of that observed in premature infants that do not develop NEC.

Classification of light Yorkshire pigs at different production stages using ordinary least squares and machine learning methods