Deep Learning Methods for Malware and Intrusion Detection: A Systematic Literature Review

Ali, Rahman; Ali, Asmat; Iqbal, Farkhund; Hussain, Mohammed; Ullah, Farhan

doi:10.1155/2022/2959222

Cited by 17 publications

(12 citation statements)

References 115 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A big problem for intrusion detection systems is dealing with harmful software that can cause network security issues and serious problems [2][3][4]. Cyber-attacks are becoming more complex, making it harder to identify new types of malicious software that aim to steal important information and avoid detection via intrusion detection systems.…”

Section: Introductionmentioning

confidence: 99%

An Optimized Hybrid Deep Intrusion Detection Model (HD-IDM) for Enhancing Network Security

Ahmad,

Imran,

Qayyum

et al. 2023

Mathematics

View full text Add to dashboard Cite

Detecting cyber intrusions in network traffic is a tough task for cybersecurity. Current methods struggle with the complexity of understanding patterns in network data. To solve this, we present the Hybrid Deep Learning Intrusion Detection Model (HD-IDM), a new way that combines GRU and LSTM classifiers. GRU is good at catching quick patterns, while LSTM handles long-term ones. HD-IDM blends these models using weighted averaging, boosting accuracy, especially with complex patterns. We tested HD-IDM on four datasets: CSE-CIC-IDS2017, CSE-CIC-IDS2018, NSL KDD, and CIC-DDoS2019. The HD-IDM classifier achieved remarkable performance metrics on all datasets. It attains an outstanding accuracy of 99.91%, showcasing its consistent precision across the dataset. With an impressive precision of 99.62%, it excels in accurately categorizing positive cases, crucial for minimizing false positives. Additionally, maintaining a high recall of 99.43%, it effectively identifies the majority of actual positive cases while minimizing false negatives. The F1-score of 99.52% emphasizes its robustness, making it the top choice for classification tasks requiring precision and reliability. It is particularly good at ROC and precision/recall curves, discriminating normal and harmful network activities. While HD-IDM is promising, it has limits. It needs labeled data and may struggle with new intrusion methods. Future work should find ways to handle unlabeled data and adapt to emerging threats. Also, making HD-IDM work faster for real-time use and dealing with scalability challenges is key for its broader use in changing network environments.

show abstract

Section: Introductionmentioning

confidence: 99%

An Optimized Hybrid Deep Intrusion Detection Model (HD-IDM) for Enhancing Network Security

Ahmad,

Imran,

Qayyum

et al. 2023

Mathematics

View full text Add to dashboard Cite

show abstract

“…To identify hostile network activity, many AI‐enabled anomaly detection techniques are reported in the literature 3‐5 . Because of the recent intensive study into malware detection pushed by the growing number of cyber‐attacks, cyber security professionals now rely on increasingly effective and efficient detection techniques, that need to be updated on a regular basis 6,7 . One of the most prevalent types of malware nowadays is network‐based malware, such as botnets, which has a negative impact on resources.…”

Section: Introductionmentioning

confidence: 99%

“…[3][4][5] Because of the recent intensive study into malware detection pushed by the growing number of cyber-attacks, cyber security professionals now rely on increasingly effective and efficient detection techniques, that need to be updated on a regular basis. 6,7 One of the most prevalent types of malware nowadays is network-based malware, such as botnets, which has a negative impact on resources. Recently AI enabled malware detection techniques built upon various kinds of features shows promising results.…”

mentioning

confidence: 99%

A robust malware traffic classifier to combat security breaches in industry 4.0 applications

Ramaiah

Vanmathi

Ravi

2023

Concurrency and Computation

View full text Add to dashboard Cite

SummaryIndustry 4.0 integrates cyber systems, physical devices, and digital networks to automate the industrial process. Many sectors aim to adopt the best practices outlined in Industry 4.0. This indicates well for the future networking of an increasing number of devices. As crucial as intelligent automation is, it is essential that it be protected. The proliferation of Internet‐enabled gadgets could raise vulnerability to a variety of threats, malware among them. Intruders see a synthesis of factors as a chance to carry out their malicious plan. Keeping sensitive data and information protected from malicious software is a high responsibility for all industries. It is critical to have both a trustworthy approach and a large dataset to work with when constructing a malware traffic classifier. Malware's capacity to elude detection by antivirus programs improves with the day. Because this malware has the potential to compromise the entire network, establishing a malware traffic classifier requires a strong approach. As the number of data increases, the classifier has a harder time distinguishing between benign and malicious network entries. As a result, weighing too many factors is a time‐consuming process. To assist with these types of real‐world challenges, we construct an effective hybrid selection component, which is subsequently followed by a neural network classifier in this research. The Malware traffic classifier provided here selects the principal feature using filter and wrapper techniques. The feature columns provided by the feature selection program are used to construct a neural network‐based binary malware classifier. The given malware traffic classification framework was tested using the MTA‐KDD'19 dataset. We set up an experiment in this investigation to examine the way different feature counts perform using a neural‐based classifier. The suggested framework achieves 96.8% accuracy while just considering the bare minimum of five features, which is a substantial increase over alternative methods.

show abstract

“…The deep learning method can deal with big datasets and gives the best performance on the data. In the new era, the researchers recommend the deep learning model for determining the malware intruders in less time [19].…”

Section: Introductionmentioning

confidence: 99%

Detection of Malware Attacks using Artiﬁcial Neural Network

Rana,

Minhaj Ahmad Khan

2023

VAWKUM trans. comput. sci.

View full text Add to dashboard Cite

Malware attacks are increasing rapidly as the technology continues to become prevalent. These attacks have become extremely difficult to detect as they continuously change their mechanism for exploitation of vulnerabilities in software. The conventional approaches to malware detection become ineffective due to a large number of varying patterns and sequences, thereby requiring artificial intelligence-based approaches for the detection of malware attacks. In this paper, we propose an artificial neural network-based model for malware detection. Our proposed model is generic as it can be applied to multiple datasets. We have compared our model with different machine-learning approaches. The experimentation results show that the proposed model can outperform other well-known approach as it achieves 99.6\% , 98.9\% and 99.9\% accuracy on the Windows API call dataset, Top PE Imports Dataset and Malware Dataset, respectively.

show abstract

Deep Learning Methods for Malware and Intrusion Detection: A Systematic Literature Review

Cited by 17 publications

References 115 publications

An Optimized Hybrid Deep Intrusion Detection Model (HD-IDM) for Enhancing Network Security

An Optimized Hybrid Deep Intrusion Detection Model (HD-IDM) for Enhancing Network Security

A robust malware traffic classifier to combat security breaches in industry 4.0 applications

Detection of Malware Attacks using Artiﬁcial Neural Network

Contact Info

Product

Resources

About