Decision-Making Method for Estimating Malware Risk Index

Abstract

Most recent cyberattacks have employed new and diverse malware. Various static and dynamic analysis methods are being introduced to detect and defend against these attacks. The malware that is detected by these methods includes advanced present threat (APT) attacks, which allow additional intervention by attackers. Such malware presents a variety of threats (DNS, C&C, Malicious IP, etc.) This threat information used to defend against variants of malicious attacks. However, the intelligence that is detected in this manner is used in the blocking policies of information-security systems. Consequently, it is difficult for staff who perform Computer Emergence Response Team security control to determine the extent to which cyberattacks such as malware are a potential threat. Additionally, it is difficult to use this intelligence to establish long-term defense strategies for specific APT attacks or implement intelligent internal security systems. Therefore, a decision-making model that identifies threat sources and malicious activities (MAs) that occur during the static and dynamic analysis of various types of collected malware and performs machine learning based on a quantitative analysis of these threat sources and activities is proposed herein. This model estimates malware risk indices (MRIs) in detail using an analytic hierarchy process to analyze malware and the probabilities of MAs. The analysis results were significant, as the consistency index of the estimated MRI values for 51300 types of malware, which were collected during a specific control period, was maintained at <0.051.

Comparing Deep Learning and Shallow Learning Techniques for API Calls Malware Prediction: A Study

“…The accuracy is tested using Random Forest Classifier reaching 98%. Kim in [15] presents a combination of static and dynamic analysis of various types of malware using several machine learning algorithms for classification aim. Moreover, the author estimates a malware risk index for using an analytic hierarchy process to detect malware and their probabilities.…”

“…Now, let analogous evaluations be performed on the APIMDS dataset. Table 9 shows the relevant API calls for three examples chosen for the goodware class (23,235,23,386,23,313) and the malware class (22,042,15,316,11,972), with similar classification compared to what was already done for the malware-analysis-datasets-api-call-sequences dataset. From Table 7, it can first be seen that, unlike the other dataset, the most frequently used API calls by goodware show rather small distance values.…”

Analysis of Cybersecurity Issues in the Maritime Industry

“…A decision-making methodology to identify threat sources and malicious activities based on the analysis of various types of malware that occur during collection processes and machine learning based on a quantitative analysis of these threat sources and activities are proposed in 12 .…”