HEAVEN: A Hardware-Enhanced AntiVirus ENgine to accelerate real-time, signature-based malware detection

Botacin, Marcus; Alves, Marco A. Z.; Oliveira, Daniela; Grégio, André

doi:10.1016/j.eswa.2022.117083

Cited by 13 publications

(12 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Botacin et al. [ 16 ] proposed a hardware-assisted signature-based malware detection. Their method is memory efficient for mobile devices, which only takes a small amount of storage and reduces the CPU’s workload.…”

Section: Related Workmentioning

confidence: 99%

Diffusion of White-Hat Botnet Using Lifespan with Controllable Ripple Effect for Malware Removal in IoT Networks

Ahmadon

Yamaguchi

2023

Sensors

View full text Add to dashboard Cite

Self-propagating malware has been infecting thousands of IoT devices and causing security breaches worldwide. Mitigating and cleaning self-propagating malware is important but challenging because they propagate unpredictably. White-hat botnets have been used to combat self-propagating malware with the concept of fight fire-with-fire. However, white-hat botnets can also overpopulate and consume the resource of IoT devices. Later, lifespan was introduced as a self-destruct measure to restrain white-hat botnets’ overpopulation, but unable to change based on real-time situations. This paper proposes a method for diffusing white-hat botnets by controlling lifespan. The main contribution of this paper is that the method uses a dynamic lifespan that increases and decreases based on the congregation’s situation of the self-propagating malware and white-hat botnets. The method tackles the problem of overpopulation of white-hat botnets since they can self-propagate by controlling the ripple effect that widens the white-hat botnet’s diffusion area but suppresses the number of white-hat botnets to achieve a ’zero-botnet’ situation. The effectiveness in reducing the overpopulation rate was confirmed. The experiment result showed that the ripple effect could reduce the number of white-hat botnets in the network by around 80%, depending on different control parameters.

show abstract

Section: Related Workmentioning

confidence: 99%

Diffusion of White-Hat Botnet Using Lifespan with Controllable Ripple Effect for Malware Removal in IoT Networks

Ahmadon

Yamaguchi

2023

Sensors

View full text Add to dashboard Cite

show abstract

“…Thanks to this method, which is also advantageous in terms of memory, the workload is taken from the operating system and loaded onto the hardware. 34 Although the use of hardware is advantageous in terms of speed and memory space, keeping the signature base up-to-date and being unprotected against zero-day attacks reduces its applicability for Android. MHCHD, is a model designed to protect virtualization environments against attacks.…”

Section: Hardware Assisted Classification Modelsmentioning

confidence: 99%

AMD‐CNN: Android malware detection via feature graph and convolutional neural networks

Arslan

Taşyürek

2022

Concurrency and Computation

View full text Add to dashboard Cite

Summary Android malware has become a serious threat to mobile device users, and effective detection and defence architectures are needed to solve this problem. Recently, machine learning techniques have been widely used to deal with Android malicious apps. These methods are based on a simple feature set and have difficulty detecting up‐to‐date malware. Therefore, more robust and efficient classification methodologies are needed. In this article, AMD‐CNN, an Android malware detection tool, is proposed, and it uses graphical representations to detect malicious apks. In the first step, the features related to the androidmanifest.xml file are extracted and converted into a vector consisting of one or zero. The feature vector is then converted to 2D‐code images and used in training the CNN network. The model needs low‐resource consumption to run on mobile devices and allow real‐time applications to be analyzed. The experiments with 1920 malicious and benign apks show that the malware detection rate (accuracy) was 96.2% and precision, recall, and F‐score values were 97.9%, 98.2%, and 98.1%, respectively. The average time and memory space to analyze each application are 0.035 s and 3.38 MB. AMD‐CNN is an efficient and robust tool and has advantages over previous studies.

show abstract

“…However, the more detailed architectural design for a dedicated accelerator provided efficiencies better for chip area, power, and processing time was required to be investigated. [30] 3.17 --Malware based on behavior chains [31] -90s -PMC-based malware detection [35] 12.5 6.825ms -MALDC [36] -20s 10% Proposed MLLD-MDQL 12.85 25.525ms 60-600kB…”

Section: Comparative Analysismentioning

confidence: 99%

“…However, the detailed architectural design for the dedicated accelerator was required for providing efficiencies with the chip area power, and processing time. Also, Botacin et al [36] developed a signature based malware detection system for accelerating the hardware-enhanced antivirus engine (HEAVEN). The workflow consisted of a hardware-assisted signature that matched the process of first step (triage) that is fast, and invokes with the software-based AV.…”

Section: Introductionmentioning

confidence: 99%

Classification of malware using multinomial linked latent modular double q learning

Kudrekar

Vinayakamurthy

2022

IJEECS

View full text Add to dashboard Cite

In recent times, malware has progressed by utilizing distinct advanced machine learning techniques for detection. However, the model becomes complicated and the singular value decomposition and depth-based malware detectors failed to detect the malware significantly with minimum time and overhead. This paper proposes a multinomial linked latent dirichlet and modular double q learning (MLLD-MDQL) to efficiently detect malware based on the network behavior patterns. First, multinomial linked latent dirichlet network behavior extraction (ML-LDNBE) is applied to the input network for anomaly detection that extracts the behavior based on the network pattern. The behavior is extracted which are grouped to perform on the path protocol for analyzing repeated behaviors. Finally, the modular double q learning malware classification model is the grouped behaviors for significant malware detection. The effectiveness of proposed MLLD-M DQL method is compared with existing models. The results obtained by the proposed method show that the model combined with the machine learning (ML) significantly determined malware detection time and also reduced the false positive rate (FPR). The results showed that the false positive rate is significantly reduced by 42% for the proposed method better when compared to the existing behavior based malware detection model that obtained 62% of FPR.

show abstract

HEAVEN: A Hardware-Enhanced AntiVirus ENgine to accelerate real-time, signature-based malware detection

Cited by 13 publications

References 15 publications

Diffusion of White-Hat Botnet Using Lifespan with Controllable Ripple Effect for Malware Removal in IoT Networks

Diffusion of White-Hat Botnet Using Lifespan with Controllable Ripple Effect for Malware Removal in IoT Networks

AMD‐CNN: Android malware detection via feature graph and convolutional neural networks

Classification of malware using multinomial linked latent modular double q learning

Contact Info

Product

Resources

About