SGSI support throught malware's classification using a pattern analysis

The research focused on studying modern malware traffic behaviors through statistical network feature application to improve detection systems. The research team conducted a quantitative analysis of traffic data which included multiple malware family samples to study their operational system requirements and their need for system resources. We evaluated more than 10,000 traffic samples through statistical methods which revealed that benign processes and malicious processes needed different resources and showed distinct operational patterns. During their operations the malware samples demonstrated rising service needs while their resource usage reached the peak value of 75% throughout their most active periods. The Trojan-Zeus variant and other related malware samples needed dynamic link libraries (DLLs) to function because they averaged 15 DLLs per sample which exceeded the 8 DLLs used by normal processes. Our research found that malware which targets operational systems achieved better system access and stealth capabilities which made it more difficult for conventional detection systems to identify them. The study results show that malware development follows an emerging pattern which requires detection systems to adapt their methods based on the distinct features of each malware type. Our research indicates that cybersecurity professionals need to integrate machine learning algorithms with statistical analysis methods in their frameworks for effective identification and prevention of upcoming security threats. The research demonstrates that cybersecurity methods require continuous innovation because modern malware threats need advanced defense systems which enable systems to withstand complex cyber threats that continue to evolve.

The security of information is among the greatest challenges facing organizations and institutions. Cybercrime has risen in frequency and magnitude in recent years, with new ways to steal, change and destroy information or disable information systems appearing every day. Among the types of penetration into the information systems where confidential information is processed is malware. An attacker injects malware into a computer system, after which he has full or partial access to critical information in the information system. This paper proposes an ensemble classification-based methodology for malware detection. The first-stage classification is performed by a stacked ensemble of dense (fully connected) and convolutional neural networks (CNN), while the final stage classification is performed by a meta-learner. For a meta-learner, we explore and compare 14 classifiers. For a baseline comparison, 13 machine learning methods are used: K-Nearest Neighbors, Linear Support Vector Machine (SVM), Radial basis function (RBF) SVM, Random Forest, AdaBoost, Decision Tree, ExtraTrees, Linear Discriminant Analysis, Logistic, Neural Net, Passive Classifier, Ridge Classifier and Stochastic Gradient Descent classifier. We present the results of experiments performed on the Classification of Malware with PE headers (ClaMP) dataset. The best performance is achieved by an ensemble of five dense and CNN neural networks, and the ExtraTrees classifier as a meta-learner.

Classification of malware for self-driving systems

As technology has advanced, the cyber threats are more advanced and common, thus it is difficult for the conventional methods to detect it. This paper explores the role of Machine Learning (ML) in the improvement of cybersecurity strategies in relation to threat detection and management. ML's pattern recognition ability is used to enhance threat recognition performance and decrease false positives. Study of past research indicates that several ML algorithms like decision tree, random forest, and convolution neural networks (CNN's), have been useful in interpreting the anomalies and distinguishing various sorts of attacks. In this paper the impact of ML algorithms on the improvement of cybersecurity especially in detecting, assessing and addressing innumerable threats present in the network traffic is reviewed. In consideration of these challenges, a system with the aim of threat classification and features extraction through use of some ML capabilities is presented. This would help in making the cyber security defences flexible and quick, encouraging timely and effective assessment and management of the threats. Some prominent areas of application of ML in the protection of cyber security are in-detecting intrusions in the networks, malware classification, preventing phishing attacks, as well as automating incident response.

In today’s digital world, Android phones play a vital part in a variety of facets of both professionals and individuals’ personal and professional lives. Android phones are great for getting things done faster and more organized. The proportionate increase in the number of malicious applications has also been seen to be expanding. Since the play store offers millions of apps, detection of malware apps is challenging task. In this paper, a methodology is introduced for detecting malware in Android applications through the utilization of global image shape transform (GIST) features extracted from grayscale images of the applications. The dataset comprises samples of both malware and benign apps collected from the virus share website. After converting the apps into grayscale images, GIST features are extracted to capture their global spatial layout. Various machine learning (ML) algorithms, such as logistic regression (LR), k-nearest neighbour (KNN), AdaBoost, decision tree (DT), Naïve Bayes (NB), random forest (RF), support vector machine (SVM), extra tree classifier (ETC), and gradient boosting (GB), are employed to classify the applications according to their GIST features. Furthermore, a feed forward neural network (FFNN) is utilized as a deep learning (DL) technique to further improve the accuracy of classification. The performance of each algorithm is evaluated using metrics such as accuracy, precision and recall. The results demonstrated that the FFNN achieves superior accuracy compared to traditional ML classifiers, indicating its effectiveness in detecting malware in Android apps.

Malware classification plays an important role in tracing the attack sources of computer security. However, existing static analysis methods are fast in classification, but they are inefficient in some malware using packing and obfuscation techniques; the dynamic analysis methods have better universality for packing and obfuscation, but they will cause excessive classification cost. To overcome these shortcomings, in this paper, we propose a classification system Malscore based on the probability scoring and machine learning, which sets the probability threshold to concatenate static analysis (called Phase 1) and dynamic analysis (called Phase 2). The convolutional neural networks with spatial pyramid pooling were used to analyze the grayscale images (static features) in Phase 1, and the variable n-grams and machine learning were used to analyze the native API call sequences (dynamic features) in Phase 2. Malscore combined static analysis with dynamic analysis not only accelerated the static analysis process by taking advantage of the CNN in image recognition but also appeared to be more resilient to obfuscation by the dynamic analysis. Different from other static and dynamic analysis techniques, when malware is detected, due to the fact that malware will most likely be labeled only by static analysis, we could reduce the overheads by dynamically analyzing a few malware that has less obvious features or greater confusion in static analysis. We performed experiments on 174607 malware samples from 63 malware families. The result showed that Malscore achieved 98.82% accuracy for malware classification. Furthermore, Malscore was compared with the method of using static and dynamic analysis. The preprocessing and test time represented a reduction of 59.58% and 61.70%, respectively.

In 2021, Thailand will become an ageing society. The policy of the health of older people is a challenging task for the Thai government that has to be carefully planned. Stroke is the first leading cause of death of older people in Thailand. Knowing the risk factors for stroke will help people to prevent stroke. In this paper, features affecting stroke are studied based on machine learning. Factors and diseases occurring before stroke are studied as features to detect stroke and find affective factors of stroke. The detection of stroke is investigated based on learning classifiers, SVM, Naive Bayes, KNN, and decision tree. Moreover, Chi2 is adopted to find affective factors of stroke. The four most affective factors of stroke are focused to know the risk of stroke. From the study, we can see that the factors are more affective than the diseases for detecting stroke and decision tree is the best classifier. Decision tree gives 72.10% of accuracy and 74.29% of F-measure. The factors affecting stroke are smoking, alcohol, cholesterol, blood pressure, sex, exercise, and occupation. Moreover, we found that no smoking can avoid stroke. Drinking alcohol, abnormal cholesterol, and abnormal blood pressure raise the risk of a stroke.

Stacking of multiple Machine Learning (ML) classifiers have gained popularity in addressing anomalous data classification along with Deep Learning (DL) algorithms. This study compares traditional ML classifiers, multi-layer stacking ML classifiers, and DL classifiers using an open-source malware dataset-containing equal numbers of benign and malware samples. The results on the realistic dataset indicate that the DL classifier, utilizing a Bidirectional Long Short-Term Memory (BiLSTM) model, outperformed the stacked classifiers with Logistic Regression (LR) and Support Vector Machine (SVM) as Meta learners by 36.78% and 39.69%, respectively, in terms of classification accuracy and performance. The research work was extended to study the impact of Generative Adversarial Network (GAN) based synthetic dataset of relatively smaller size on deep learning models. It was observed that the Deep Learning Multi-Layer Perceptron (DLMLP) Model had relatively superior performance as compared to complex deep learning models like Long Short-Term Memory LSTM and BiLSTM

In the development of social science and technology, the number of mobile malware has shown a large-scale upward trend with the continuous expansion of technology. The increasing feature library not only increases the difficulty for security vendors to deal with malware samples, but also detects practical techniques. The method puts forward higher requirements. Although mobile malware detection methods with machine learning as the core can get rid of the limitations of traditional detection modes and process large sample data in a timely and effective manner, there are still problems such as low detection rate and excessive number of features. Therefore, on the basis of understanding the current development trend of mobile software detection technology, this paper proposes a multi-level classification ensemble model with a decision tree as the core. The final results show that the feature selection algorithm based on mean and variance proposed in this paper, the malware detection algorithm based on feature extraction, and the mobile malware detection algorithm based on multi-level integration can all effectively detect malware samples in the platform.

An automated accurate sound-based amateur drone detection method based on skinny pattern

Antimalware offers detection mechanism to detect and take appropriate action against malware detected. To evade detection, malware authors had introduced polymorphism to malware. In order to be effectively analyzing and classifying large amount of malware, it is necessary to group and identify them into their corresponding families. Hence, malware classification has appeared as a need in securing our computer systems. Algorithms and classifiers such as k-Nearest Neighbor, Artificial Neural Network, Support Vector Machine, Naive Bayes, and Decision Tree had shown their effectiveness towards malware classification in various recent researches. This paper proposed the concept of ensemble classifications to classify malwares, in which three individual classifiers, k-Nearest Neighbor, Decision Tree and Naive Bayes classifiers are ensemble by using the bagging approach.

This study presents a malware classification system designed to classify malicious processes at run-time on production hosts. The system monitors process-level system call activity and uses information extracted from system call traces as inputs to the classifier. The system is advantageous because it does not require the use of specialized analysis environments. Instead, a ‘lightweight’ service application monitors process execution and classifies new malware samples based on their behavioral similarity to known malware. This study compares the effectiveness of multiple feature sets, ground truth labeling schemes, and machine learning algorithms for malware classification. The accuracy of the classification system is evaluated against processlevel system call traces of recently discovered malware samples collected from production environments. Experimental results indicate that accurate classification results can be achieved using relatively short system call traces and simple representations.

Recent years have witnessed the very rapid increase in both the volume and sophistication of malware programs. Malware authors invest heavily in technologies and capabilities to streamline the process of building and mutating existing malware programs to evade traditional protection. One major challenge currently faced by the antivirus industry is to efficiently process the vast amount of incoming suspicious samples. Since most new malware is a variation of an existing malware family with the same forms of malicious behavior, automatic clustering and classification of malware programs into families have become valuable tools for malware analysts. Such grouping criteria not only allow analysts to prioritize the allocation of their investigation efforts but may also be applied to detect new malware samples based on their association with existing families. In this paper, we address the multi-class malware classification challenge from a scalability perspective. We present the design, development, and evaluation of a novel machine learning classifier trained on multifaceted content features (e.g., instruction sequences, strings, section information, and other malware features) as well as threat intelligence gathered from external sources (e.g., antivirus output). Our experiments on a dataset of 21,741 malware samples demonstrate the efficacy and precision of the proposed algorithm and also provide insights into the utility of various features.

In recent years, infections and damage caused by malware have increased at exponential rates. At the same time, machine learning (ML) techniques have shown tremendous promise in many domains, often out performing human efforts by learning from large amounts of data. Results in the open literature suggest that ML is able to provide similar results for malware detection, achieving greater than 99% classification accuracy [49]. However, the same detection rates when applied in deployed settings have not been achieved. Malware is distinct from many other domains in which ML has shown success in that (1) it purposefully tries to hide, leading to noisy labels and (2) often its behavior is similar to benign software only differing in intent, among other complicating factors. This report details the reasons for the difficultly of detecting novel malware by ML methods and offers solutions to improve the detection of novel malware. We propose to detect malware by detecting behaviors commonly exhibited by malware such as DLL injection, and process hollowing. This is based on the assumption that there is a set of behaviors that are common to most malware samples and detecting them will generalize to novel malware. Additionally, detected behaviors point analysts toward appropriate handling and mitigation strategies, which is not the case with a binary benign/malicious classification. A behavior labeling method was developed and was used to label an existing malware dataset. Results show that detecting malicious behaviors is much more difficult than simply classifying malware and goodware?achieving 80% accuracy compared to reported 99% accuracy from classifying malware and goodware. This drop is due to several reasons which are detailed in the report. We also propose to evaluate the performance of detecting novel malware by holding out a malware family for testing and training on the other families. Traditional ML evaluation will shuffle the data and then split the data into training and testing. Our method addresses the use-case when novel malware families are encountered and they require more than just a malicious or benign designation. Our results suggest that this type of evaluation is much more difficult than traditional methods and provides more realistic results, albeit, significantly worse. For our behavior detection, accuracy decreases from 80% to 68% across all behaviors when holding out a malware family from training. We show that the degradation in performance is because each malware family has distinct characteristics resulting in high extrapolations by an ML model. Here, an ML model should return an "I do not know" response and request further analysis from an analyst. We run a number of experiments that compare novel malware families to the training data using different feature representations including a genomics-inspired distance measure and features extracted by deep learning. Generally, held-out families are significantly different from the training data, resulting in unpredictable results. This has been observed generally in the ML community [22, 9]. We empirically demonstrate this in the domain of malware detection. In an attempt to improve the detection of malware behaviors, we examine the impact that additional synthetic data has on the performance of an ML model in detecting behaviors in novel malware families. We find that while synthetic data does improve the performance of ML models, often simpler methods perform better than more complicated ones. Two generative modeling techniques were examined to produce synthetic malware samples such that the behaviors present are able to be specified externally. The difficulty is due to finer grained analysis of the executable and modifying the problem from a binary classification problem to a multi-label problem. The addition of synthetic data increases the overall accuracy from 68% to 70%. While far less accurate than measures presented in academic analyses, we believe that this is more representative of real-world performance and allows models to be properly placed within a malware detection system. We suggest that in highly dynamic environments ML pipelines should determine whether an ML model is competent in the area of new data and should involve mechanisms to improve over time with a human in the loop.

Internet of Medical Things (IoMT) is network of interconnected medical devices (smart watches, pace makers, prosthetics, glucometer, etc.), software applications, and health systems and services. IoMT has successfully addressed many old healthcare problems. But it comes with its drawbacks essentially with patient’s information privacy and security related issues that comes from IoMT architecture. Using obsolete systems can bring security vulnerabilities and draw attacker’s attention emphasizing the need for effective solution to secure and protect the data traffic in IoMT network. Recently, intrusion detection system (IDS) is regarded as an essential security solution for protecting IoMT network. In the past decades, machines learning (ML) algorithms have demonstrated breakthrough results in the field of intrusion detection. Notwithstanding, to our knowledge, there is no work that investigates the power of machines learning algorithms for intrusion detection in IoMT network. This paper aims to fill this gap of knowledge investigating the application of different ML algorithms for intrusion detection in IoMT network. The investigation analysis includes ML algorithms such as K-nearest neighbor, Naïve Bayes, support vector machine, artificial neural network and decision tree. The benchmark dataset, Bot-IoT which is publicly available with comprehensive set of attacks was used to train and test the effectiveness of all ML models considered for investigation. Also, we used comprehensive set of evaluation metrics to compare the power of ML algorithms with regard to their detection accuracy for intrusion in IoMT networks. The outcome of the analysis provides a promising path to identify the best the machine learning approach can be used for building effective IDS that can safeguard IoMT network against malicious activities.