A Novel Machine Learning Approach for Malware Detection

Kumar, Tarun; Sharma, Sanjeev; Goel, Himanshu; Memoria, Minakshi

doi:10.2139/ssrn.3383953

Cited by 1 publication

(2 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Many studies have already been performed on malware detection in various operating systems and file types for both executable and non-executable files. For example, [6], [5], [8]- [12] proposed solutions for the detection of malware in executable files using machine learning. In 2019, [13] presented a survey of machine learning techniques for malware analysis in Windows portable executables (PEs).…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

MalJPEG: Machine Learning Based Solution for the Detection of Malicious JPEG Images

2020

View full text Add to dashboard Cite

In recent years, cyber-attacks against individuals, businesses, and organizations have increased. Cyber criminals are always looking for effective vectors to deliver malware to victims in order to launch an attack. Images are used on a daily basis by millions of people around the world, and most users consider images to be safe for use; however, some types of images can contain a malicious payload and perform harmful actions. JPEG is the most popular image format, primarily due to its lossy compression. It is used by almost everyone, from individuals to large organizations, and can be found on almost every device (on digital cameras and smartphones, websites, social media, etc.). Because of their harmless reputation, massive use, and high potential for misuse, JPEG images are used by cyber criminals as an attack vector. While machine learning methods have been shown to be effective at detecting known and unknown malware in various domains, to the best of our knowledge, machine learning methods have not been used particularly for the detection of malicious JPEG images. In this paper, we present MalJPEG, the first machine learningbased solution tailored specifically at the efficient detection of unknown malicious JPEG images. MalJPEG statically extracts 10 simple yet discriminative features from the JPEG file structure and leverages them with a machine learning classifier, in order to discriminate between benign and malicious JPEG images. We evaluated MalJPEG extensively on a real-world representative collection of 156,818 images which contains 155,013 (98.85%) benign and 1,805 (1.15%) malicious images. The results show that MalJPEG, when used with the LightGBM classifier, demonstrates the highest detection capabilities, with an area under the receiver operating characteristic curve (AUC) of 0.997, true positive rate (TPR) of 0.951, and a very low false positive rate (FPR) of 0.004. INDEX TERMS JPEG, image, malware, detection, machine learning, features. I. INTRODUCTION Cyber attacks targeting individuals, businesses, and organizations have increased in recent years. Infosecurity magazine declared that cyber attacks doubled in 2017. 1 Cyber attacks usually include harmful activities such as stealing confidential information, spying, or monitoring, and cause harm (sometimes significant) to the victim. Attackers may be motivated by ideology, criminal intent, a desire for publicity, etc. Attackers are constantly searching for new and effective ways to launch attacks and deliver a malicious payload to The associate editor coordinating the review of this manuscript and approving it for publication was Inês Domingues. 1 https://www.infosecurity-magazine.com/news/cyberattacks-doubled-in-2017/ victims. Files sent via the Internet have often served as a means of accomplishing this. Since executable files (i.e., * .exe) are known to be dangerous, attackers are increasingly using non-executable files (e.g., * .pdf, * .docx, etc.) which are mistakenly considered to be safe for use by most users. Some non-executable files allow...

show abstract

Section: Related Workmentioning

confidence: 99%

“…Ascan contains a complete encoding of one or more image components. 12 Figure 2 presents the structure of a simple JPEG image file and the hierarchy of the markers and their division into frames and scans. The markers in bold are mandatory or the most common markers.…”

Section: Introductionmentioning

confidence: 99%