A Study on the Effect of Feature Selection on Malware Analysis using Machine Learning

Babaagba, Kehinde O.; Adesanya, Samuel O.

doi:10.1145/3318396.3318448

Cited by 28 publications

(14 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Some features might provide limited information on the actual contents of malicious applications to the classifier [41,42]. The imperative goals of any malware-detection system include the identification of a subset of features from the entire feature set, with subsequent reduction in the high data dimensionality.…”

Section: Feature Selection Metricsmentioning

confidence: 99%

Automated Malware Detection in Mobile App Stores Based on Robust Feature Generation

Alazab

2020

Electronics

View full text Add to dashboard Cite

Many Internet of Things (IoT) services are currently tracked and regulated via mobile devices, making them vulnerable to privacy attacks and exploitation by various malicious applications. Current solutions are unable to keep pace with the rapid growth of malware and are limited by low detection accuracy, long discovery time, complex implementation, and high computational costs associated with the processor speed, power, and memory. Therefore, an automated intelligence technique is necessary for detecting apps containing malware and effectively predicting cyberattacks in mobile marketplaces. In this study, a system for classifying mobile marketplaces applications using real-world datasets is proposed, which analyzes the source code to identify malicious apps. A rich feature set of application programming interface (API) calls is proposed to capture the regularities in apps containing malicious content. Two feature-selection methods—Chi-Square and ANOVA—were examined in conjunction with ten supervised machine-learning algorithms. The detection accuracy of each classifier was evaluated to identify the most reliable classifier for malware detection using various feature sets. Chi-Square was found to have a higher detection accuracy as compared to ANOVA. The proposed system achieved a detection accuracy of 98.1% with a classification time of 1.22 s. Furthermore, the proposed system required a reduced number of API calls (500 instead of 9000) to be incorporated as features.

show abstract

Section: Feature Selection Metricsmentioning

confidence: 99%

Automated Malware Detection in Mobile App Stores Based on Robust Feature Generation

Alazab

2020

Electronics

View full text Add to dashboard Cite

show abstract

“…Firstly, we will use ROC, in which x-axis is FPR (defined by Eq (18)) and y-axis is TPR (defined by Eq (19)), and AUC, which denotes the area under ROC curve, to verify the effectiveness of the original DeepDetectNet, the result of which will be used as the baseline for later experiments.…”

Section: Procedures Of Experimentsmentioning

confidence: 99%

“…Santos I et al [13], Gandotra E et al [14], Niu Z et al [15], Wang C et al [16], and Hu X et al [17] extracts the opcode sequence of a PE file with external tools, and then takes the sequence as the input of the deep learning model, allowing the learning model to extract features automatically. Babaagba KO et al [18] concluded the method for feature selection.…”

Section: Introductionmentioning

confidence: 99%

DeepDetectNet vs RLAttackNet: An adversarial method to improve deep learning-based static malware detection model

Fang

Yuetian

et al. 2020

PLoS ONE

View full text Add to dashboard Cite

Deep learning methods are being increasingly widely used in static malware detection field because they can summarize the feature of malware and its variants that have never appeared before. But similar to the picture recognition model, the static malware detection model based on deep learning is also vulnerable to the interference of adversarial samples. When the input feature vectors of the malware detection model is based on static features of Windows PE (Portable Executable, PE) file, the model is vulnerable to gradient-based attacks. Regarding the issue above, a method of adversarial sample generation is proposed, which can summarize the blind spots of the original detection model. However, the existing malware adversarial sample generation method is not universal and low in generation efficiency due to the need for human control and difficulty in maintaining a normal file format. In response to these problems, this paper proposes a novel method of automatic adversarial samples generation based on deep reinforcement learning. Firstly, a static PE malware detection model based on deep learning called DeepDetectNet is constructed, the original AUC of which can reach 0.989. Then, an adversarial sample generation model based on reinforcement learning called RLAttackNet is implemented, which generates malware samples that can bypass DeepDetectNet. Finally, when we re-input the adversarial samples into the previously trained DeepDetectNet, the original defects of DeepDetectNet can be reinforced. Experimental results show that the RLAttackNet proposed in this paper can generate about 19.13% of malware samples bypass DeepDetectNet. When DeepDe-tectNet is retrained with these adversarial samples, the AUC value improves from 0.989 to 0.996 and attack success rate has a significant drop, from 19.13% to 3.1%, compared with the original model.

show abstract

“…The original feature vectors are usually of high dimensions with some useless features, increasing in time cost and decreasing in accuracy [31]- [35]. Therefore, it is necessary to perform certain dimensionality reduction on features.…”

Section: Feature Selection and Similarity Measurementmentioning

confidence: 99%

Semi-Supervised Malware Clustering Based on the Weight of Bytecode and API

Fang

Zhang

et al. 2020

IEEE Access

View full text Add to dashboard Cite

With the rapid advances of anti-virus and anti-tracking technologies, three aspects in malware clustering need to be improved for effective clustering, i.e., the robustness of features, the accuracy of similarity measurements, and the effectiveness of clustering algorithms. In this paper, we propose a novel malware family clustering approach based on dynamic and static features with their weights. In this approach, we employ a new similarity measurement method based on EMD to improve the accuracy of feature similarities. In addition, to reduce convergence time and improve clustering purity, we design a novel semi-supervised clustering algorithm, termed as S-DBSCAN by involving supervision information into the original algorithm known as Density-Based Spatial Clustering of Applications with Noise (DBSCAN). The experimental results demonstrate that the proposed approach can correctly and accurately distinguish the samples among various families and achieve outperformed purity with 98.7%. INDEX TERMS EMD, hybrid features, semi-supervised clustering, weight.

show abstract

A Study on the Effect of Feature Selection on Malware Analysis using Machine Learning

Cited by 28 publications

References 24 publications

Automated Malware Detection in Mobile App Stores Based on Robust Feature Generation

Automated Malware Detection in Mobile App Stores Based on Robust Feature Generation

DeepDetectNet vs RLAttackNet: An adversarial method to improve deep learning-based static malware detection model

Semi-Supervised Malware Clustering Based on the Weight of Bytecode and API

Contact Info

Product

Resources

About