Malware Classification Framework using Convolutional Neural Network

Khan, M. Danial; Baig, Duaa; Khan, Usman Ali; Karim, Ahmad

doi:10.1109/iccws48432.2020.9292384

Cited by 17 publications

(5 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…They are well known for their ability to extract features from the training data without requiring manual feature extraction. These models are preferred for predictions requiring pattern recognition, including image object detection [25], hate speech detection [26], [27], document classification [28], bot detection [29], human activity detection [30], malware detection [31], audio identification [32]. Typically, a CNN model is composed of the following layers:…”

Section: Model Details and Experimental Setup A Convolutional Neural ...mentioning

confidence: 99%

Explainable YouTube Video Identification Using Sufficient Input Subsets

et al. 2023

View full text Add to dashboard Cite

Neural network models are black boxes in nature. The mechanics behind these black boxes are practically unexplainable. Having the insight into patterns identified by these algorithms can help unravel important properties of the subject in query. These artificial intelligence based algorithms are used in every domain for prediction. This research focuses on patterns formed in network traffic that can be leveraged to identify videos streaming over the network. The proposed work uses a sufficient input subset (SIS) model on two separate video identification techniques to understand and explain the patterns detected by the techniques. The first technique creates the fingerprints of videos on a period-based algorithm to handle variable bitrate inconsistencies. These fingerprints are passed to a convolutional Neural Network (CNN) for pattern recognition. The second technique is based on traffic pattern plot identification that creates a graph of packet size with respect to time for each stream before passing that to a CNN as an image. For model explainability, a sufficient input subset (SIS) model is used to identify features that are sufficient to reach the same prediction under a certain threshold of confidence by the model. The generated SIS of each input sample is clustered using DBSCAN, K-Means, and cosine-based Hierarchical clustering. The clustered SIS highlight the common patterns for each class. The SIS patterns learnt by each model of three individual videos are discussed. Furthermore, these patterns are used to investigate misclassification and provide a rationale behind it to justify the working of the classifier model.

show abstract

Section: Model Details and Experimental Setup A Convolutional Neural ...mentioning

confidence: 99%

Explainable YouTube Video Identification Using Sufficient Input Subsets

et al. 2023

View full text Add to dashboard Cite

show abstract

“…A CNN generally consists of convolution layers, pooling layers, and a fully connected layer. They are mainly used in pattern recognition and their architecture makes them a preferred model for object detection in image, voice in audio, natural language processing (hate speech detection [2], [51], [52]), activity recognition (bot detection [11], human activity recognition [53], malware detection [3]), and classify digital signals.…”

Section: E Convolutional Neural Network (Cnn) Modelmentioning

confidence: 99%

“…For the security and privacy of clients, internet traffic is encrypted, leaving little or no possibility of monitoring stream content. Minors and adolescents can be induced to inappropriate content with unmonitored traffic [2], [3]. Most video streaming platforms, such as YouTube, Facebook, and Twitch, have adopted dynamic adaptive streaming over HTTP (DASH) technology to enhance the client's quality of experience (QoE).…”

mentioning

confidence: 99%

Fingerprinting Technique for YouTube Videos Identification in Network Traffic

et al. 2022

View full text Add to dashboard Cite

Recently, many video streaming services, such as YouTube, Twitch, and Facebook, have contributed to video streaming traffic, leading to the possibility of streaming unwanted and inappropriate content to minors or individuals at workplaces. Therefore, monitoring such content is necessary. Although the video traffic is encrypted, several studies have proposed techniques using traffic data to decipher users' activity on the web. Dynamic Adaptive Streaming over HTTP (DASH) uses Variable Bit-Rate (VBR) -the most widely adopted video streaming technology, to ensure smooth streaming. VBR causes inconsistencies in video identification in most research. This research proposes a fingerprinting method to accommodate for VBR inconsistencies. First, bytes per second (BPS) are extracted from the YouTube video stream. Bytes per Period (BPP) are generated from the BPS, and then fingerprints are generated from these BPPs. Furthermore, a Convolutional Neural Network (CNN) is optimized through experiments. The resulting CNN is used to detect YouTube streams over VPN, Non-VPN, and a combination of both VPN and Non-VPN network traffic.

show abstract

“…The Convolutional Neural Network has been successful in many classification tasks, such as in natural language processing (hate speech detection [4,32,33], bot detection [34]), human activity recognition [35], malware detection [36], and image processing. The proposed model does not require additional hand-crafted features for the classification of videos but learns the patterns within the sequence of BPS itself.…”

Section: Cnn Modelmentioning

confidence: 99%

SCNN-Attack: A Side-Channel Attack to Identify YouTube Videos in a VPN and Non-VPN Network Traffic

et al. 2022

View full text Add to dashboard Cite

Encryption Protocols e.g., HTTPS is utilized to secure the traffic between servers and clients for YouTube and other video streaming services, and to further secure the communication, VPNs are used. However, these protocols are not sufficient to hide the identity of the videos from someone who can sniff the network traffic. The present work explores the methodologies and features to identify the videos in a VPN and non-VPN network traffic. To identify such videos, a side-channel attack using a Sequential Convolution Neural Network is proposed. The results demonstrate that a sequence of bytes per second from even one-minute sniffing of network traffic is sufficient to predict the video with high accuracy. The accuracy is increased to 90% accuracy in the non-VPN, 66% accuracy in the VPN, and 77% in the mixed VPN and non-VPN traffic, for models with two-minute sniffing.

show abstract

Malware Classification Framework using Convolutional Neural Network

Cited by 17 publications

References 9 publications

Explainable YouTube Video Identification Using Sufficient Input Subsets

Explainable YouTube Video Identification Using Sufficient Input Subsets

Fingerprinting Technique for YouTube Videos Identification in Network Traffic

SCNN-Attack: A Side-Channel Attack to Identify YouTube Videos in a VPN and Non-VPN Network Traffic

Contact Info

Product

Resources

About