Obfuscated malware detection using dilated convolutional network

Mezina, Anzhelika; Bürget, Radim

doi:10.1109/icumt57764.2022.9943443

Cited by 10 publications

(17 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Note that RobustCBL achieved slightly higher accuracy due to its larger parameter size, whereas CompactCBL performed remarkably well despite being nearly 40% smaller than RobustCBL. Moreover, both models outperformed Mezina et al's Dilated CNN model [31] by 1.03% and 0.7%, respectively, which is the sole other work to evaluate multiclass classification on this dataset and reported by the authors. They also evaluated the performance of Decision Tree, but with less successful outcomes.…”

Section: Attack Family Detectionmentioning

confidence: 52%

“…Results with this split show that RobustCBL and CompactCBL attain accuracies of 0.9994 and 0.9985, respectively, compared with 0.9943 obtained by the LSTM model in [27]. [31] 0.9992 0.99 0.99 0.99 6037 LSTM [27] 0.9943 0.99 1.00 0.99 627 Decision Tree [31] 0.9990 0.99 1.00 0.99 Not given Stacking [18] 0.9902 0.99 0.99 0.99 Not given…”

Section: Binary Attack Detectionmentioning

confidence: 92%

“…Mezina et al [31] present a method to address the problem of obfuscated malware from memory information, utilizing the CIC-Malmem-2022 dataset created by [18], as a means of evaluating the efficacy of a dilated convolutional network (DCNN) in identifying hidden malware. DCNNs have been identified as a powerful tool for this task due to their ability to cover a large field of information, which is useful for uncovering hidden malware.…”

Section: Detecting Attack Families or Attack Types (Multiclass Classi...mentioning

confidence: 99%

“…In alignment with the studies in [18,31], our models have been evaluated with an 80-20% division of training and test data (as we mentioned before). However, the LSTM model in [27] employed a 70-30% split.…”

Section: Binary Attack Detectionmentioning

confidence: 99%

“…Thus, we compared our models' weight size to that of DCNN. However, as no model size for DCNN was reported in [31], therefore, we reconstructed an approximate model based on their description, which yielded a size closer to 6 MB, rendering it unsuitable for most sensors and IoT end devices. As alluded to in Section 3, resource-constrained devices, such as IoT devices for real-time or quasi-real-time applications in smart cities, where response times are within 1 ms, require ML models of at most 1 MB size.…”

Section: Attack Family Detectionmentioning

confidence: 99%

See 4 more Smart Citations

Obfuscated Memory Malware Detection in Resource-Constrained IoT Devices for Smart City Applications

Shafin

Karmakar

Mareels

2023

Sensors

View full text Add to dashboard Cite

Obfuscated Memory Malware (OMM) presents significant threats to interconnected systems, including smart city applications, for its ability to evade detection through concealment tactics. Existing OMM detection methods primarily focus on binary detection. Their multiclass versions consider a few families only and, thereby, fail to detect much existing and emerging malware. Moreover, their large memory size makes them unsuitable to be executed in resource-constrained embedded/IoT devices. To address this problem, in this paper, we propose a multiclass but lightweight malware detection method capable of identifying recent malware and is suitable to execute in embedded devices. For this, the method considers a hybrid model by combining the feature-learning capabilities of convolutional neural networks with the temporal modeling advantage of bidirectional long short-term memory. The proposed architecture exhibits compact size and fast processing speed, making it suitable for deployment in IoT devices that constitute the major components of smart city systems. Extensive experiments with the recent CIC-Malmem-2022 OMM dataset demonstrate that our method outperforms other machine learning-based models proposed in the literature in both detecting OMM and identifying specific attack types. Our proposed method thus offers a robust yet compact model executable in IoT devices for defending against obfuscated malware.

show abstract

Section: Attack Family Detectionmentioning

confidence: 52%

Section: Binary Attack Detectionmentioning

confidence: 92%

Section: Detecting Attack Families or Attack Types (Multiclass Classi...mentioning

confidence: 99%

Section: Binary Attack Detectionmentioning

confidence: 99%

Section: Attack Family Detectionmentioning

confidence: 99%

See 3 more Smart Citations

Obfuscated Memory Malware Detection in Resource-Constrained IoT Devices for Smart City Applications

Shafin

Karmakar

Mareels

2023

Sensors

View full text Add to dashboard Cite

show abstract

Enhancing malware detection performance: leveraging K-Nearest Neighbors with Firefly Optimization Algorithm

Al Saaidah,

Abualhaj,

Shambour

et al. 2024

Multimed Tools Appl

View full text Add to dashboard Cite

Obfuscated Privacy Malware Classifiers Based on Memory Dumping Analysis

Cevallos-Salas,

Grijalva,

Estrada-Jiménez

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Malware targeting user privacy has seen a surge in recent times, attributed to evolving global regulations and the boost of electronic commerce and online services. Moreover, recognizing privacy malware that employs obfuscation as evasion mechanism presents a major challenge due to its dynamics, resilience, and polymorphism at runtime, necessitating the application of forensic techniques such as memory dumping analysis in order to reveal suitable patterns and behaviors that enable its subsequent detection and classification. In this paper, we present three obfuscated privacy malware classifiers trained on the CIC-MalMem-2022 dataset. These solutions include a binary classifier to distinguish benign from malicious samples using logistic regression (LR), a multiclass classifier that further categorizes benign, spyware, ransomware, and trojan horse obfuscated privacy malware; and a more detailed multiclass classifier capable of discriminating benign samples from fifteen specific obfuscated privacy malware families. Multiclass classifiers were built using several traditional machine learning algorithms and a novel Deep Neural Network (DNN). We applied the Synthetic Minority Oversampling Technique (SMOTE) to address data imbalances. In particular, our results demonstrate that DNN outperforms traditional machine learning algorithms, yielding statistically significant improvements in key metrics. These achievements reach practical thresholds, suggesting the potential for enhanced malware protection systems. The dataset and all the coding files required for experiments reproducibility are publicly available at https://github.com/dcevallossalas/PrivacyMalwareClassifiers.

show abstract

Obfuscated malware detection using dilated convolutional network

Cited by 10 publications

References 13 publications

Obfuscated Memory Malware Detection in Resource-Constrained IoT Devices for Smart City Applications

Obfuscated Memory Malware Detection in Resource-Constrained IoT Devices for Smart City Applications

Enhancing malware detection performance: leveraging K-Nearest Neighbors with Firefly Optimization Algorithm

Obfuscated Privacy Malware Classifiers Based on Memory Dumping Analysis

Contact Info

Product

Resources

About