A novel malware classification and augmentation model based on convolutional neural network

Tekerek, Adem; Yapıcı, Muhammed Mutlu

doi:10.1016/j.cose.2021.102515

Cited by 44 publications

(18 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These approaches can be used to increase the accuracy of the classification model by about 2% to 20% with newly generated data samples. Also, it has been verified through several experiments that data augmentation has a positive effect on malware analysis and detection research [11,13,21,26,36]. On the other hand, there is a line of research work that uses the excellent performance of computer vision research to visualize malware as an image to augment data and detect malware [11,13,21].…”

Section: Malware Data Augmentationmentioning

confidence: 93%

“…Malware belonged in a specific malware family has distinguishable characteristics of malicious actions. Therefore, in order to detect malware faster and more accurately, a lot of research on malware analysis and detection based on deep learning algorithms was conducted [10][11][12][13][14][15][16][17][18][19][20][21][22]. To effectively analyze/classify the rapidly increasing number of malware, it is more effective to classify malware in detail by family or behavior than to classify benign/malicious [12,23].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Augmenting Android Malware Using Conditional Variational Autoencoder for the Malware Family Classification

Ban¹,

Yi²,

Cho³

2023

Computer Systems Science and Engineering

View full text Add to dashboard Cite

Android malware has evolved in various forms such as adware that continuously exposes advertisements, banking malware designed to access users' online banking accounts, and Short Message Service (SMS) malware that uses a Command & Control (C&C) server to send malicious SMS, intercept SMS, and steal data. By using many malicious strategies, the number of malware is steadily increasing. Increasing Android malware threats numerous users, and thus, it is necessary to detect malware quickly and accurately. Each malware has distinguishable characteristics based on its actions. Therefore, security researchers have tried to categorize malware based on their behaviors by conducting the familial analysis which can help analysists to reduce the time and cost for analyzing malware. However, those studies algorithms typically used imbalanced, well-labeled open-source dataset, and thus, it is very difficult to classify some malware families which only have a few number of malware. To overcome this challenge, previous data augmentation studies augmented data by visualizing malicious codes and used them for malware analysis. However, visualization of malware can result in misclassifications because the behavior information of the malware could be compromised. In this study, we propose an android malware familial analysis system based on a data augmentation method that preserves malware behaviors to create an effective multi-class classifier for malware family analysis. To this end, we analyze malware and use Application Programming Interface (APIs) and permissions that can reflect the behavior of malware as features. By using these features, we augment malware dataset to enable effective malware detection while preserving original malicious behaviors. Our evaluation results demonstrate that, when a model is created by using only the augmented data, a macro-F1 score of 0.65 and accuracy of 0.63%. On the other hand, when the augmented data and original malware are used together, the evaluation results show that a macro-F1 score of 0.91 and an accuracy of 0.99%.

show abstract

Section: Malware Data Augmentationmentioning

confidence: 93%

Section: Introductionmentioning

confidence: 99%

Augmenting Android Malware Using Conditional Variational Autoencoder for the Malware Family Classification

Ban¹,

Yi²,

Cho³

2023

Computer Systems Science and Engineering

View full text Add to dashboard Cite

show abstract

“…In the area of malware detection and classification, four large datasets are often used to find and categorize malware. These datasets are BIG2015 [ 48 ], MalImg [ 49 ], Malicia [ 50 ], and Malevis [ 51 ]. However, none of these datasets contains the PE files to examine the source file.…”

Section: Methodsmentioning

confidence: 99%

Memory Visualization-Based Malware Detection Technique

Shah

Jamil²,

Khan³

2022

Sensors

View full text Add to dashboard Cite

Advanced Persistent Threat is an attack campaign in which an intruder or team of intruders establishes a long-term presence on a network to mine sensitive data, which becomes more dangerous when combined with polymorphic malware. This type of malware is not only undetectable, but it also generates multiple variants of the same type of malware in the network and remains in the system’s main memory to avoid detection. Few researchers employ a visualization approach based on a computer’s memory to detect and classify various classes of malware. However, a preprocessing step of denoising the malware images was not considered, which results in an overfitting problem and prevents us from perfectly generalizing a model. In this paper, we introduce a new data engineering approach comprising two main stages: Denoising and Re-Dimensioning. The first aims at reducing or ideally removing the noise in the malware’s memory-based dump files’ transformed images. The latter further processes the cleaned image by compressing them to reduce their dimensionality. This is to avoid the overfitting issue and lower the variance, computing cost, and memory utilization. We then built our machine learning model that implements the new data engineering approach and the result shows that the performance metrics of 97.82% for accuracy, 97.66% for precision, 97.25% for recall, and 97.57% for f1-score are obtained. Our new data engineering approach and machine learning model outperform existing solutions by 0.83% accuracy, 0.30% precision, 1.67% recall, and 1.25% f1-score. In addition to that, the computational time and memory usage have also reduced significantly.

show abstract

“…The malware detection method is categorized into signature and behavior methods [5]. Now, signaturebased malware detector effectively works with formerly known malware that has been detected previously by anti-malware vendors.…”

Section: Introductionmentioning

confidence: 99%

Optimal Deep Belief Network Enabled Malware Detection and Classification Model

Chandran¹,

Rajini²,

Jeyakarthic³

2023

Intelligent Automation &Amp; Soft Computing

View full text Add to dashboard Cite

Cybercrime has increased considerably in recent times by creating new methods of stealing, changing, and destroying data in daily lives. Portable Document Format (PDF) has been traditionally utilized as a popular way of spreading malware. The recent advances of machine learning (ML) and deep learning (DL) models are utilized to detect and classify malware. With this motivation, this study focuses on the design of mayfly optimization with a deep belief network for PDF malware detection and classification (MFODBN-MDC) technique. The major intention of the MFODBN-MDC technique is for identifying and classifying the presence of malware exist in the PDFs. The proposed MFODBN-MDC method derives a new MFO algorithm for the optimal selection of feature subsets. In addition, Adamax optimizer with the DBN model is used for PDF malware detection and classification. The design of the MFO algorithm to select features and Adamax based hyperparameter tuning for PDF malware detection and classification demonstrates the novelty of the work. For demonstrating the improved outcomes of the MFODBN-MDC model, a wide range of simulations are executed, and the results are assessed in various aspects. The comparison study highlighted the enhanced outcomes of the MFODBN-MDC model over the existing techniques with maximum precision, recall, and F1 score of 97.42%, 97.33%, and 97.33%, respectively.

show abstract

A novel malware classification and augmentation model based on convolutional neural network

Cited by 44 publications

References 19 publications

Augmenting Android Malware Using Conditional Variational Autoencoder for the Malware Family Classification

Augmenting Android Malware Using Conditional Variational Autoencoder for the Malware Family Classification

Memory Visualization-Based Malware Detection Technique

Optimal Deep Belief Network Enabled Malware Detection and Classification Model

Contact Info

Product

Resources

About