Sequential opcode embedding-based malware detection method

Malicious software also known as "Malware" is software that uses legitimate instructions or code to perform malicious actions. Malware poses a major threat for computer security and information security in general. Over the years, malware has evolved to the point that a single malware specimen can have hundreds or maybe thousands of variants using polymorphic and metamorphic transformation to change the signature of the malware variant in propagation. The common signature-based malware detection methods are no longer robust to detect these variants due to the alteration of code. Static analysis is required to obtain these signatures and anti-virus companies are required to propagate these signature updates to their software. A faster detection method is needed to compensate the exponentially increasing number of malware variants. Machine learning is a trending approach for malware detection. This removes the need to use signature-based detection and is also faster. Software companies do not need to propagate signatures as often. Machine learning algorithms using opcode sequences can recognise patterns in the malicious code that are not present in common signatures and classify them more efficiently. Therefore, a machine learning approach for malware detection should be adopted for faster and more efficient detection. Most research in malware detection using machine learning used static attributes such as network connections, processes spawned, hashes, etc., that were not that robust to changes. In this paper we introduced our novel approach in using trigrams and PE file attributes as features for malware detection. We took a text mining approach to make our detection method more robust to polymorphism and metamorphism. The instruction sequence for critical code in malware on the assembly level is basically the same across malware families. We used opcode trigram sequences as the main feature for our machine learning algorithm. We used Support Vector Machine(SVM) as our classifying algorithm which is a discriminative classifier model that gives a definite decision whether the predicted outcome belongs to the learned class or not. The above shows our novel approach that enabled us to get higher detection rates with less features.

Malware is a major threat to the computer security. There are so many variants of malware evolving each day which results the loss in economy as well as data and personal information is precious than economy. Malware prevention can be achieved by carefully analyzing the content of the EULA. As EULA analysis deals with analyzing the unstructured text documents, text mining concept plays an important role. This paper analyzes the detection mechanism for malware detection, using text mining over an ample set of existing EULA. The comparison presented in this paper highlights some malware analysis and text mining techniques. Although there are several malware detection systems exist, evolution and revolution is required to fill the gap in malware evolution and detection. In order to achieve the goal or to verify the authenticity of an executable, this paper provides an alternate approach to detect the malware before execution. EULA analysis which acts as gateway can be included in other behavioral or data mining based malware detection system to achieve both external and internal security of the computing system including mobile devices.

Data mining techniques have been concentrated for malware detection in the recent decade. The battle between security analyzers and malware scholars is everlasting as innovation grows. The proposed methodologies are not adequate while evolutionary and complex nature of malware is changing quickly and therefore turn out to be harder to recognize. This paper presents a systematic and detailed survey of the malware detection mechanisms using data mining techniques. In addition, it classifies the malware detection approaches in two main categories including signature-based methods and behavior-based detection. The main contributions of this paper are: (1) providing a summary of the current challenges related to the malware detection approaches in data mining, (2) presenting a systematic and categorized overview of the current approaches to machine learning mechanisms, (3) exploring the structure of the significant methods in the malware detection approach and (4) discussing the important factors of classification malware approaches in the data mining. The detection approaches have been compared with each other according to their importance factors. The advantages and disadvantages of them were discussed in terms of data mining models, their evaluation method and their proficiency. This survey helps researchers to have a general comprehension of the malware detection field and for specialists to do consequent examinations.

Malicious software (ransom ware) cyber attacks in frequency and severity, posing an increasingly serious threat to computer systems everywhere. Malware detection is a hot study area as several multiple computers, organisations, and governments have been affected by an exponential rise in malware attacks. Dynamic and static assessment of malicious characteristics and behaviour patterns is time expensive and useless in real-time malware detection, according to current technologies. It is becoming increasingly common for malicious apps to use polymorphic and adaptive techniques to rapidly modify their behaviour and develop a number of new malicious apps. In order to undertake an effective malware analysis, machine learning techniques (MLAs) are increasingly being used to create new malware varieties. This approach is time-consuming since it requires considerable feature engineering, learning and representation of features. Moreover the feature extraction process could be effectively eliminated by using advanced MLAs like deep learning. These methods have been shown to perform better with a biased training dataset, which restricts their practical application in real-time scenarios. A new improved approach for successful zero-day malware detection must be developed in order to eliminate biases and analyze these approaches autonomously.

Due to its damage to Internet security, malware and its detection has caught the attention of both anti-malware industry and researchers for decades. Many research efforts have been conducted on developing intelligent malware detection systems. In these systems, resting on the analysis of file contents extracted from the file samples, like Application Programming Interface (API) calls, instruction sequences, and binary strings, data mining methods such as Naive Bayes and Support Vector Machines have been used for malware detection. However, driven by the economic benefits, both diversity and sophistication of malware have significantly increased in recent years. Therefore, anti-malware industry calls for much more novel methods which are capable to protect the users against new threats, and more difficult to evade. In this paper, other than based on file contents extracted from the file samples, we study how file relation graphs can be used for malware detection and propose a novel Belief Propagation algorithm based on the constructed graphs to detect newly unknown malware. A comprehensive experimental study on a real and large data collection from Comodo Cloud Security Center is performed to compare various malware detection approaches. Promising experimental results demonstrate that the accuracy and efficiency of our proposed method outperform other alternate data mining based detection techniques.

GHGDroid: Global heterogeneous graph-based android malware detection

With the technological development and means of communication, the Internet of Things (IoT) has become an essential role in providing many services in daily life through millions of heterogeneous but interconnected devices and nodes. This development is opening to many security and privacy challenges that can cause complete network breakdown, bypassed access control or the loss of critical data. This paper attempts to provide a preliminary analysis for malware detection within data generated by IoT-based devices and services in the form of operational codes (Opcode) sequences. Three machine learning algorithms are evaluated and compared for accuracy, precision, recall and F-measure. The results showed that the Random Forest (RF) achieved the best accuracy of 98%, followed by SVM and k-NN, both with 91%. The results are further analyzed based on the Receiver Operating Characteristic (ROC) curve and Precision-Recall curve to further illustrate the difference in performance of all three algorithms when dealing with IoT data.

A novel deep learning-based approach for malware detection

Today, in the field of malware detection, the expanding limitations of traditional detection methods and the increasing accuracy of detection methods designed on the basis of artificial intelligence algorithms are driving research findings in this area in favour of the latter. Therefore, we propose a novel malware detection model in this paper. This model combines a grey-scale image representation of malware with an autoencoder network in a deep learning model, analyses the feasibility of the grey-scale image approach of malware based on the reconstruction error of the autoencoder, and uses the dimensionality reduction features of the autoencoder to achieve the classification of malware from benign software. The proposed detection model achieved an accuracy of 96% and a stable F-score of about 96% by using the Android-side dataset we collected, which outperformed some traditional machine learning detection algorithms.

Over the past few years, Android Application is deemed as one of the fastest-growing technology areas. On the other hand, the rapid growth of android applications also increases the security threats for Android users in the form of malware. Malware hacks the personal information of a user and exploits it in different criminal activities. To date, various studies have been conducted for the detection of android malware. Some authors have preferred static analysis while others have performed dynamic analysis for android malware detection. In static analysis, researchers have only employed one feature of android application either intents or permissions. As best of our knowledge, there does not exist any technique that combines both intents and permissions. In this paper, we have performed static analysis for the detection of Android malware using android intents (both implicit and explicit), android permissions and combination of intents and permissions. Furthermore, the classification is performed to analyze the effectiveness of different machine learning algorithms for malware detection and to identify the best performing feature. Our experiment results show that combination of intents and permissions play a key role in the detection of android malware.

A literature survey shows that the number of malware attacks is gradually growing over the years due to the growing trend of Internet of Medical Things (IoMT) devices. To detect and classify malware attacks, automated malware detection and classification is an essential subsystem in healthcare cyber-physical systems. This work proposes an attention-based multidimensional deep learning (DL) approach for a cross-architecture IoMT malware detection and classification system based on byte sequences extracted from Executable and Linkable Format (ELF; formerly named Extensible Linking Format) files. The DL approach automates the feature design and extraction process from unstructured byte sequences. In addition, the proposed approach facilitates the detection of the central processing unit (CPU) architecture of the ELF file. A detailed experimental analysis and its evaluation are shown on the IoMT cross-architecture benchmark dataset. In all the experiments, the proposed method showed better performance compared with those obtained from several existing methods with an accuracy of 95% for IoMT malware detection, 94% for IoMT malware classification, and 95% for CPU architectures classification. The proposed method also suggests a similar performance with an accuracy of 94% on the Microsoft malware dataset. Experimental results on two malware datasets indicate that the proposed method is robust and generalizable in cross-architecture IoMT malware detection, classification, and CPU architectures classification in healthcare cyber-physical systems.

With the increasing reliance of human society on computer systems in daily life, cybercrime is also on the rise. Malware is increasingly used by cybercriminals to attack, compromise, and steal sensitive information, and more critically, to demand ransom from users of infected systems. Existing antivirus solutions often fall short in detecting and alerting users to attacks carried out by newly developed or evolving malware strains. This highlights the need for a more robust and proactive strategy for malware detection. This paper presents a hybrid approach for advanced malware detection, integrating the identification of suspicious code executing in main memory with the analysis of malware-related events in Windows Event Logs. Experiments were conducted using a code injection technique on Windows 7 and Windows 10 systems, and the corresponding memory images and Event Logs were analyzed to validate the effectiveness of the proposed approach. Training and testing were performed on both code-based and event-based datasets to evaluate detection accuracy. For the detection of suspicious code, we employed the Canadian Institute for Cybersecurity-Malware in Memory 2023 (CIC-MalMem 2023) dataset. For event-based analysis, we utilized the EVTX-ATTACK-SAMPLES and the Windows Event Log dataset. Experimental results using the Random Forest (RF)classifier demonstrate a detection accuracy of 99% based on suspicious code and 95% based on Event Log data

The amount of malware infecting computers and other communication devices and migrating across the internet has greatly increased over the years. Numerous methods and procedures have been put forth up to this point to find and eliminate these hostile agents. However, a lot of malwares is still being developed, which can get past some cutting-edge malware detection algorithms, as new and automated malware production techniques emerge. Consequently, there is a need for the classification and detection of these antagonistic agents that have the potential to compromise the security of individuals, businesses, and a wide range of other digital assets. To develop a new improved approach for efficient zero-day malware detection, there is a compelling need to reduce bias and objectively assess these methods. This study focuses on investigating transfer learning strategies for malware picture classification, including AlexNet, VGG16, VGG19, GoogLeNet, and ResNet. Here, malware binaries are turned into grayscale images before being processed using models for classification based on transfer learning. As transfer learning uses pre-trained models, the primary objective is to save training time. In addition, an effective model for malware classification will be built in order to obtain performance that is unbiased.

Local binary feature learning has attracted a lot of researches in image recognition due to its vital effectiveness. Generally, in the traditional local feature learning methods, a projection is learned to map the patches of image into binary features and then a codebook is generated by clustering the binary features with K-means clustering. However, these local feature learning methods, such as compact binary face descriptor and discriminative binary descriptor, ignore the category specific distributions of the original features during the feature learning process and use the real-valued clustering approach to generate the codebook, the discriminant of feature is degraded and the merits of binary feature are lost. To tack these problems, in this paper, we propose a novel category-preserving binary feature learning and binary codebook leaning (CPBFL-BCL) method for finger vein recognition. In CPBFL-BCL, the discrimination of learned binary features is generated by criteria of fisher discriminant analysis and category manifold preserving regularity during the feature learning process, and a novel binary clustering method based on K-means clustering is designed to generate binary codebook. Experimental results on recognition and retrieval tasks using two public finger vein databases are presented and demonstrate the effectiveness and efficiency of the proposed method over the state-of-the-art finger vein methods and a finger vein retrieval method.

Android OS is today the most used Operating System for mobile devices. However, it is susceptible to several malware attacks that may seriously compromise the privacy and security of individuals and organizations. This paper proposes an approach based on a static analysis of decompiled Android PacKages (APKs) to extract critical APIs and detect Android malware. The main contributions lie in the adoption of a graph-based data engineering schema to represent APIs taken from the Function Call Graphs of decompiled APKs and the formulation of a graph-based deep learning approach for explainable malware detection. In particular, the proposed approach, named , implements a Graph Neural Network (GNN) for binary classification (malware versus goodware), and integrates algorithm to disclose how specific API classes and control-flow edges between API calls influence malware alerts. The proposed approach was evaluated by considering 26,527 Android APKs. The results of an extensive and in-depth evaluation show that the presented GNN model achieves higher accuracy than deep neural models trained with traditional API call sequence representations and publicly available related methods. On the other hand, it produces decision explanations that yield interesting insights into the malicious patterns of APKs and support root cause analysis of missed malware alarms.