Multifamily Classification of Android Malware With a Fuzzy Strategy to Resist Polymorphic Familial Variants

Liu, Xiaojian; Du, Xi; Lei, Qian; Liu, Kehong

doi:10.1109/access.2020.3019282

Cited by 9 publications

(12 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As shown in Figure (8), the proposed ABIL-MVD with both sliding window size of 46 and 128 sample outperforms the fixed incremental batch with all tested incremental batch. It can also be noted from Figure (8) that as the batch size decreases the accuracy is improve while the corresponding error rate decreases as shown in Figure (9). Although this property is desirable, it is noted that the small fixed size incremental batch increases the update frequency and disrupt the normal operation of the malware detection.…”

Section: Figure 7 Results Of Comparison Between the Proposed Adaptive Batch Size (Aibl-mvd) With The Fixed Batch Size (Ibl)mentioning

confidence: 82%

“…More particularly, accuracy of the model will be slightly degraded during the warning level and will be boosted after updated when the batch window is full or out of control state is occurred. Figure (8) and Figure (9) show the detailed results of the performance of both fixed batch window size and adaptive batch window size in terms of detection accuracy in Figure (8) and classification error in Figure (9). As can be observed, in both figures the proposed concept-driftbased adaptive incremental batch performs better than the other fixed batch size incremental learning strategies.…”

Section: Figure 5 Base Classifier Selectionmentioning

confidence: 78%

“…According to AV report [7], 350,000 malware are detected every day, 7 million malware attacks were reported in 2019, and the total number of malware worldwide will exceed 1.13 billion by the end of 2020. Most of the malware files are propagated through the internet and most of the new malware is malware variants [1,8,9]. Malware authors increase the complexity of the previous malware files and generate new variants to evade detection.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

An Adaptive Behavioral-Based Incremental Batch Learning Malware Variants Detection Model Using Concept Drift Detection and Sequential Deep Learning

et al. 2021

View full text Add to dashboard Cite

Malware variants are the major emerging threats that face cybersecurity due to the potential damage to computer systems. Many solutions have been proposed for detecting malware variants. However, accurate detection is challenging due to the constantly evolving nature of the malware variants that cause concept drift. Existing malware detection solutions assume that the mapping learned from historical malware features will be valid for new and future malware. The relationship between input features and the class label has been considered stationary, which doesn't hold for the ever-evolving nature of malware variants. Malware features change dynamically due to code obfuscations, mutations, and the modification made by malware authors to change the features' distribution and thus evade the detection rendering the detection model obsolete and ineffective. This study presents an Adaptive behavioral-based Incremental Batch Learning Malware Variants Detection model using concept drift detection and sequential deep learning (AIBL-MVD) to accommodate the new malware variants. Malware behavior were extracted using dynamic analysis by running the malware files in a sandbox environment and collecting their Application Programming Interface (API) traces. According to the malware first-time appearance, the malware samples were sorted to capture the malware variants' change characteristics. The base classifier was then trained based on a subset of historical malware samples using a sequential deep learning model. The new malware samples were mixed with a subset of old data and gradually introduced to the learning model in an adaptive batch size incremental learning manner to address the catastrophic forgetting dilemma of the incremental learning. The statistical process control technique has been used to detect the concept drift as indication for incrementally updating the model as well as reducing the frequency of model updates. Results from extensive experiments show that the proposed model is superior in terms of detection rate and the efficiency compared with the static model, periodic retraining approaches, and the fixed batch size incremental learning approach. The model maintains an average of 99.41% detection accuracy of new and variants malware with a low updating frequency of 1.35 times per month.

show abstract

Section: Figure 7 Results Of Comparison Between the Proposed Adaptive Batch Size (Aibl-mvd) With The Fixed Batch Size (Ibl)mentioning

confidence: 82%

Section: Figure 5 Base Classifier Selectionmentioning

confidence: 78%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

An Adaptive Behavioral-Based Incremental Batch Learning Malware Variants Detection Model Using Concept Drift Detection and Sequential Deep Learning

et al. 2021

View full text Add to dashboard Cite

show abstract

“…A class of objects with a range of membership degrees is referred to as a fuzzy set [25]. This type of set defines a membership (characteristic) function that assigns each object a membership degree ranging between [0, 1] [26].…”

Section: Fuzzy Optimized Feature Selectionmentioning

confidence: 99%

A Two-Tier Fuzzy Meta-Heuristic Hybrid Optimization for Dynamic Android Malware Detection

Jhansi¹,

Chakravarty²,

Varma³

2022

Journal of Cyber Security

View full text Add to dashboard Cite

Application Programming Interface (API) call feature analysis is the prominent method for dynamic android malware detection. Standard benchmark android malware API dataset includes features with high dimensionality. Not all features of the data are relevant, filtering unwanted features improves efficiency. This paper proposes fuzzy and meta-heuristic optimization hybrid to eliminate insignificant features and improve the performance. In the first phase fuzzy benchmarking is used to select the top best features, and in the second phase meta-heuristic optimization algorithms viz., Moth Flame Optimization (MFO), Multi-Verse Optimization (MVO) & Whale Optimization (WO) are run with Machine Learning (ML) wrappers to select the best from the rest. Five ML methods viz., Decision Tree (DT), Random Forest (RF), K-Nearest Neighbors (KNN), Naïve Bayes (NB) & Nearest Centroid (NC) are compared as wrappers. Several experiments are conducted and among them, the best post reduction accuracy of 98.34% is recorded with 95% elimination of features. The proposed novel method outperformed among the existing works on the same dataset.

show abstract

“…This type of solution, on the other hand, is incapable of detecting malware that isn't in the database. As malware is becoming more prevalent, it is vital to present a solution that can accurately detect all varieties of malware [6], while using the least amount of time and resources possible.…”

Section: Introductionmentioning

confidence: 99%

Swarm Optimization and Machine Learning for Android Malware Detection

Jhansi¹,

Varma²,

Chakravarty³

2022

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

Malware Security Intelligence constitutes the analysis of applications and their associated metadata for possible security threats. Application Programming Interfaces (API) calls contain valuable information that can help with malware identification. The malware analysis with reduced feature space helps for the efficient identification of malware. The goal of this research is to find the most informative features of API calls to improve the android malware detection accuracy. Three swarm optimization methods, viz., Ant Lion Optimization (ALO), Cuckoo Search Optimization (CSO), and Firefly Optimization (FO) are applied to API calls using auto-encoders for identification of most influential features. The nature-inspired wrapperbased algorithms are evaluated using well-known Machine Learning (ML) classifiers such as Linear Regression (LR), Decision Tree (DT), Random Forest (RF), K-Nearest Neighbor (KNN) & Support Vector Machine (SVM). A hybrid Artificial Neuronal Classifier (ANC) is proposed for improving the classification of android malware. The experimental results yielded an accuracy of 98.87% with just seven features out of hundred API call features, i.e., a massive 93% of data optimization.

show abstract

Multifamily Classification of Android Malware With a Fuzzy Strategy to Resist Polymorphic Familial Variants

Cited by 9 publications

References 32 publications

An Adaptive Behavioral-Based Incremental Batch Learning Malware Variants Detection Model Using Concept Drift Detection and Sequential Deep Learning

An Adaptive Behavioral-Based Incremental Batch Learning Malware Variants Detection Model Using Concept Drift Detection and Sequential Deep Learning

A Two-Tier Fuzzy Meta-Heuristic Hybrid Optimization for Dynamic Android Malware Detection

Swarm Optimization and Machine Learning for Android Malware Detection

Contact Info

Product

Resources

About