Identification of malware families using stacking of textural features and machine learning

Kumar, Sanjeev; Janet, B.; Neelakantan, Subramanian

doi:10.1016/j.eswa.2022.118073

Cited by 23 publications

(11 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The features learned at lower layers are strengthened in higher layers. These characteristics support CNNs in producing an effective outcome ( Kumar, Janet & Neelakantan, 2022 ). In addition, the computational cost is minimized by limiting the size of the dataset.…”

Section: Introductionmentioning

confidence: 76%

“…The Internet of Things (IoT) connects the real and virtual worlds ( Mu et al, 2021 ; Ben Atitallah, Driss & Almomani, 2022 ). New business models and global interactions emerge as people, products, technologies, and the internet become more interconnected ( Kumar, Janet & Neelakantan, 2022 ). Cybercriminals are increasingly targeting IoT devices because they are easy targets for exploiting weak authentication, outdated firmware, and malware due to the complexity of design and implementation in hardware and software ( Khan & Salah, 2018 ).…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Artificial intelligence-driven malware detection framework for internet of things environment

Alsubai

Dutta²,

Alnajim

et al. 2023

PeerJ Computer Science

View full text Add to dashboard Cite

The Internet of Things (IoT) environment demands a malware detection (MD) framework for protecting sensitive data from unauthorized access. The study intends to develop an image-based MD framework. The authors apply image conversion and enhancement techniques to convert malware binaries into RGB images. You only look once (Yolo V7) is employed for extracting the key features from the malware images. Harris Hawks optimization is used to optimize the DenseNet161 model to classify images into malware and benign. IoT malware and Virusshare datasets are utilized to evaluate the proposed framework’s performance. The outcome reveals that the proposed framework outperforms the current MD framework. The framework generates the outcome at an accuracy and F1-score of 98.65 and 98.5 and 97.3 and 96.63 for IoT malware and Virusshare datasets, respectively. In addition, it achieves an area under the receiver operating characteristics and the precision-recall curve of 0.98 and 0.85 and 0.97 and 0.84 for IoT malware and Virusshare datasets, accordingly. The study’s outcome reveals that the proposed framework can be deployed in the IoT environment to protect the resources.

show abstract

Section: Introductionmentioning

confidence: 76%

Section: Introductionmentioning

confidence: 99%

Artificial intelligence-driven malware detection framework for internet of things environment

Alsubai

Dutta²,

Alnajim

et al. 2023

PeerJ Computer Science

View full text Add to dashboard Cite

show abstract

“…The malware detection rate (accuracy) is 96.2%, with precision, recall, and F-scores of 97.9%, 98.2%, and 98.1%, respectively. Kumar et al [16] use an AVClass tool and a clustering technique to systematically label the binary samples. The labelled malicious program is shown in grayscale images so that local and global textural features can be extracted.…”

Section: Comparison With Other Methodsmentioning

confidence: 99%

“…In terms of detecting malware, the detection rate is 96.2%, with precision at 97.9%, recall at 98.2%, and F-scores at 98.1%. Kumar et al [16] used bitwise samples for sequentially labelling using the AVClass tool and a clustering method. The malicious program is depicted in grayscale so that local and global textural characteristics can be extracted.…”

Section: Literature Reviewmentioning

confidence: 99%

A malware detection system using a hybrid approach of multi-heads attention-based control flow traces and image visualization

2022

View full text Add to dashboard Cite

Android is the most widely used mobile platform, making it a prime target for malicious attacks. Therefore, it is imperative to effectively circumvent these attacks. Recently, machine learning has been a promising solution for malware detection, which relies on distinguishing features. While machine learning-based malware scanners have a large number of features, adversaries can avoid detection by using feature-related expertise. Therefore, one of the main tasks of the Android security industry is to consistently propose cutting-edge features that can detect suspicious activity. This study presents a novel feature representation approach for malware detection that combines API-Call Graphs (ACGs) with byte-level image representation. First, the reverse engineering procedure is used to obtain the Java programming codes and Dalvik Executable (DEX) file from Android Package Kit (APK). Second, to depict Android apps with high-level features, we develop ACGs by mining API-Calls and API sequences from Control Flow Graph (CFG). The ACGs can act as a digital fingerprint of the actions taken by Android apps. Next, the multi-head attention-based transfer learning method is used to extract trained features vector from ACGs. Third, the DEX file is converted to a malware image, and the texture features are extracted and highlighted using a combination of FAST (Features from Accelerated Segment Test) and BRIEF (Binary Robust Independent Elementary Features). Finally, the ACGs and texture features are combined for effective malware detection and classification. The proposed method uses a customized dataset prepared from the CIC-InvesAndMal2019 dataset and outperforms state-of-the-art methods with 99.27% accuracy.

show abstract

“…The proliferation of sophisticated malware has been fueled by feature rich programming languages and powerful open-source encryption and AI libraries [6][7][8] . Modern malware and recycled variants, that have been slightly changed or obfuscated, easily defeat widely used signature-based and heuristic-based detection methods such as anti-virus and malware scanners [9][10][11][12][13][14][15] . AI is becoming essential in detecting modern malware however, the accuracy of an AI model in detecting malware is contingent on the quality of the features it is trained with.…”

Section: Introductionmentioning

confidence: 99%

Defeating Evasive Malware with Peekaboo: Extracting Authentic Malware Behavior with Dynamic Binary Instrumentation

Gaber,

Ahmed,

Janicke

2024

Preprint

View full text Add to dashboard Cite

The accuracy of Artificial Intelligence (AI) in malware detection is dependent on the features it is trained with, where the quality and authenticity of these features is dependent on the dataset and the analysis tool. Evasive malware, that alters its behavior in analysis environments, is challenging to extract authentic features from where widely used static and dynamic analysis tools have several limitations. However, Dynamic Binary Instrumentation (DBI) allows deep and precise control of the malware sample, thereby facilitating the extraction of authentic behavior from evasive malware. Considering the limitations of malware analysis for use with AI, this research had two primary objectives: investigation of the evasive techniques used by modern malware and the creation of Peekaboo, a DBI tool to extract authentic data from live malware samples. Peekaboo instruments and defeats evasive techniques that target analysis tools and virtual environments. A dataset of 20,500 samples was assembled and each sample was run for up to 15 minutes to observe not only the anti-analysis techniques used but also its complete behavior. Peekaboo outperforms other tools on several fronts, it is the only tool to measure start and completion rates, capture the executed Assembly (ASM) instructions, record all network traffic and implements the largest coverage against evasive techniques.

show abstract

Identification of malware families using stacking of textural features and machine learning

Cited by 23 publications

References 31 publications

Artificial intelligence-driven malware detection framework for internet of things environment

Artificial intelligence-driven malware detection framework for internet of things environment

A malware detection system using a hybrid approach of multi-heads attention-based control flow traces and image visualization

Defeating Evasive Malware with Peekaboo: Extracting Authentic Malware Behavior with Dynamic Binary Instrumentation

Contact Info

Product

Resources

About