MACoMal: A Multi-Agent Based Collaborative Mechanism for Anti-Malware Assistance

Abstract

Anti-malware tools remain the primary line of defense against malicious software. There is a wide variety of commercial anti-malware tools in the IT security market. However, no single tool is able to provide a full protection against the overwhelming number of daily released malware. Hence, collaboration among malware detection tools is of paramount importance. In this paper, we propose MACoMal, a multiagent based decision mechanism, which assists heterogeneous anti-malware tools to collaborate with each other in order to reach a consensual decision about the maliciousness of a suspicious file. MACoMal consists of two main elements: (1) an executable file identification model, and (2) a collaborative decision-making scheme. MACoMal is analyzed with respect to network connectivity and global decision correctness. By leveraging a multi-agent simulation tool and a set of real malware samples, we present a simulation methodology to assess its effectiveness and efficiency. Experimental results show that MACoMal is able to immunize a network against a malware threat within a time that ranges from a few seconds to a few minutes after the threat detection.

BSLnO: Multi‐agent based distributed intrusion detection system using Bat Sea Lion Optimization‐based hybrid deep learning approach

“…The developed n‐gram opcode‐sequence‐based signature model effectively identified anomalous attacks and its variants of the same family. The system was not effective in reducing FPR, which is a major barrier 30 …”

A Survey on Multi-Agent Based Collaborative Intrusion Detection Systems

“…It is based on sharing data and/or resources between nodes and coordinating them in order to improve the security of networks or an entire system [126,160,114]. The collaborative approach proved its effectiveness in detecting vulnerabilities and analyzing security, predicting attacks, and protecting sensitive information, as well as for its ability to address the challenges of traditional security [126,160,16,114].…”

Development of Software to Protect Executable Files

“…A significant number of research works is devoted to the issues of ensuring the software integrity, as well as its protection against unauthorized copying and modification. Methods of protection used for Windows OS are researched in work of А. Ільєнко 4 . The review of methods used for the protection of the program code and executable files is presented in work of I. Stepanenko 5 , J. Tevis 6 , L. Van Duong 7 .…”