A Novel Method for Detecting Future Generations of Targeted and Metamorphic Malware Based on Genetic Algorithm

Abstract

This paper presents a novel solution for detecting rare and mutating malware programs and provides a strategy to address the scarcity of datasets for modeling these types of malware. To provide sufficient training data for malware behavioral modeling, genetic algorithms are used together with an optimization strategy that selectively creates generations of mutated elite malware samples. In our unique method, a sequence of system API calls is extracted using tracker filter drivers in a sandbox environment. The most obfuscated and metamorphic malware are chosen by an elite selection method. The behavioral chromosomes are formed by mapping extracted APIs to genes using linear regression. Our analysis system includes an Internet simulator and a human emulator to deceive intelligent classes of malware to successfully execute themselves and prevent system halting. The evolution process is performed through crossover and permutation of genes, which are encoded based on the addresses of the kernel-level system functions. An objective function has been defined to optimize the vital indicators of malignancy and tracking rate with a linear time complexity. This guarantees that new generations of malware are more destructive and stealthy than their parents. J48 and deep neural networks were employed in our experiments as they are two popular modeling and classification strategies in the area of behavioral malware detection. Real-world malware samples from valid references were used for the performance evaluation of our approach. Comprehensive scenarios were involved in the experiments to evaluate the performance of our proposed strategy. The results demonstrate significant improvement in detection accuracy -up to 5% considering rare and metamorphic malware. The results also demonstrated a considerable enhancement in true positive rate for the proposed deep-learning algorithm.

ACMFNN: Design of an augmented convolutional model for intelligent cross-domain malware localization via forensic neural networks

“…fMeasure values for different models Figure8. fMeasure values for different models Similar to precision and recall, this evaluation, and figure8evaluate that an improvement of 12.8% when compared with 2D CNN[8], 10.5% when compared with MMGA[11], and 9.4% when compared with RNN[19] in terms of fMeasure is obtained due to incorporation of Forensic Neural Network (FNN) with Augmented Convolutional Models (ACMs) for identification of different malware types. Results of the model in terms of localization can be observed from figure9(a), and 9 (b), wherein binary file is converted into 2D vectors, and malware affected regions are marked with brighter colour levels.…”

“…Researchers can also integrate explainable AI to understand the source of malwares for different binary-specific use cases. Average Recall for Different Models 2D CNN [8] MMGA [11] RNN [19] ACM FNN…”

“…For instance, work in [1,2,3] proposes use of call graphs, system calls, and explainable Artificial Intelligence (AI) methods for improving classification & localization performance under real-time cyber physical systems. Similar models are discussed in [4,5,6 [10], and Metamorphic Malware detection via Genetic Algorithm (MMGA) [11] are discussed by researchers. These models utilize large-scale & high-density feature extraction techniques in order to improve accuracy of detection & localization of malwares with different signatures.…”

“…RNN [19]; for comparison with the proposed model. The models proposed in 2D CNN [8], MMGA [11] & RNN [19] were trained & validated, the same set of data samples during evaluation. This assisted in estimating real-time performance of the reviewed models on similar simulation conditions.…”

“…This efficiency was evaluated for Electro RAT, Pegasus, SkyGoFree, Viking Horde, Bat Skull, Yesmile, Wirenet, Jigsaw, Satana, & Tapaoux datasets in terms of accuracy, precision, recall, and fMeasure performance. These datasets were downloaded from the following sources,  Hybrid Analysis, which is available at https://www.hybrid-analysis.com/filecollections  Malware Bazaar database, which is available at https://bazaar.abuse.ch/browse/  Malware Tips database, which is available at https://malwaretips.com/forums/malwaresamples.104/  VXVault database, which is available at http://vxvault.net//ViriList.php  Malware Traffic Net database, which is available at https://www.malware-trafficanalysis.net/ Based on these datasets and comparison attributes, performance was evaluated for 2D CNN [8], MMGA [11]. RNN [19]; for comparison with the proposed model.…”