CloudIntell: An intelligent malware detection system

Mirza, Qublai Khan Ali; Awan, Irfan; Younas, Muhammad

doi:10.1016/j.future.2017.07.016

Cited by 43 publications

(15 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…ese features are input into SVM to detect computer worms. Ali Mirza et al [22] use the refined features extracted from the software to create training data by considering each feature as boolean. And then, they integrate SVM and decision trees learning these training data to detect malware.…”

Section: Malware Classificationmentioning

confidence: 99%

Incremental Learning for Malware Classification in Small Datasets

Xue

et al. 2020

Security and Communication Networks

View full text Add to dashboard Cite

Information security is an important research area. As a very special yet important case, malware classification plays an important role in information security. In the real world, the malware datasets are open-ended and dynamic, and new malware samples belonging to old classes and new classes are increasing continuously. This requires the malware classification method to enable incremental learning, which can efficiently learn the new knowledge. However, existing works mainly focus on feature engineering with machine learning as a tool. To solve the problem, we present an incremental malware classification framework, named “IMC,” which consists of opcode sequence extraction, selection, and incremental learning method. We develop an incremental learning method based on multiclass support vector machine (SVM) as the core component of IMC, named “IMCSVM,” which can incrementally improve its classification ability by learning new malware samples. In IMC, IMCSVM adds the new classification planes (if new samples belong to a new class) and updates all old classification planes for new malware samples. As a result, IMC can improve the classification quality of known malware classes by minimizing the prediction error and transfer the old model with known knowledge to classify unknown malware classes. We apply the incremental learning method into malware classification, and the experimental results demonstrate the advantages and effectiveness of IMC.

show abstract

Section: Malware Classificationmentioning

confidence: 99%

Incremental Learning for Malware Classification in Small Datasets

Xue

et al. 2020

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…Furthermore, Zonouz et al [37] designed a cloud-based service, namely, Secloud, that emulates a version of the smartphone device inside the cloud and synchronizes the devices inputs and the network connections to detect malware. Mirza et al [38] introduced a cloud-based scalable service, namely, CloudIntell, that is hosted on Amazon web services (AWS) for detecting malware via machine learning techniques.…”

Section: Cloud-based Methodsmentioning

confidence: 99%

Identifying Malicious Software Using Deep Residual Long-Short Term Memory

Alotaibi

2019

IEEE Access

View full text Add to dashboard Cite

The use of smartphone applications based on the Android OS platform is rapidly growing among smartphone users. However, malicious apps for Android are being developed to perform attacks, such as destroying operating systems, stealing confidential data, gathering personal information, and hijacking or encrypting sensitive data. Several malware detection systems based on machine learning have been developed and deployed to extract a variety of features to prevent such attacks. However, new efficient detection methods are needed to extract complex features and hidden structures from malicious apps to detect malware. This paper proposes a novel framework, namely, MalResLSTM, based on deep residual long short-term memory to identify and classify malware variants. The framework imposes a set of constraints on the deep learning architecture to capture dependencies between the extracted features from the Android package kit (APK) file. These feature sets are mapped to a vector space to process the input sequence using a sequence model based on the residual LSTM network. To evaluate the performance of the proposed framework, several experiments are conducted on the Drebin dataset, which contains 129,013 applications. The results demonstrate that MalResLSTM can achieve a 99.32% detection accuracy and outperforms previous algorithms. An extensive experimental analysis was conducted, which included machine-learningbased algorithms and a variety of deep learning-based algorithms, to evaluate the efficiency and robustness of our proposed framework.

show abstract

“…Deep learning-based detection approaches are effective to detect new malware and reduce features space sharply [108], [109], but it is not resistant to some evasion attacks. On the other hand, cloud-based detection approaches increase DR, decrease FPs, and provide bigger malware databases and powerful computational resources [110]. The overhead between client and server, and lack of real monitoring are still a challenging tasks in cloud environment.…”

Section: Evaluation On Malware Detection Approachesmentioning

confidence: 99%

A Comprehensive Review on Malware Detection Approaches

2020

View full text Add to dashboard Cite

According to the recent studies, malicious software (malware) is increasing at an alarming rate, and some malware can hide in the system by using different obfuscation techniques. In order to protect computer systems and the Internet from the malware, the malware needs to be detected before it affects a large number of systems. Recently, there have been made several studies on malware detection approaches. However, the detection of malware still remains problematic. Signature-based and heuristic-based detection approaches are fast and efficient to detect known malware, but especially signature-based detection approach has failed to detect unknown malware. On the other hand, behavior-based, model checking-based, and cloud-based approaches perform well for unknown and complicated malware; and deep learning-based, mobile devices-based, and IoT-based approaches also emerge to detect some portion of known and unknown malware. However, no approach can detect all malware in the wild. This shows that to build an effective method to detect malware is a very challenging task, and there is a huge gap for new studies and methods. This paper presents a detailed review on malware detection approaches and recent detection methods which use these approaches. Paper goal is to help researchers to have a general idea of the malware detection approaches, pros and cons of each detection approach, and methods that are used in these approaches.

show abstract

CloudIntell: An intelligent malware detection system

Cited by 43 publications

References 16 publications

Incremental Learning for Malware Classification in Small Datasets

Incremental Learning for Malware Classification in Small Datasets

Identifying Malicious Software Using Deep Residual Long-Short Term Memory

A Comprehensive Review on Malware Detection Approaches

Contact Info

Product

Resources

About