Performance evaluation of various ensemble classifiers for malware detection

Dhanya, L.; Chitra, R.; Bamini, A.M. Anusha

doi:10.1016/j.matpr.2022.03.696

Cited by 8 publications

(6 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The academic industry has suggested a deep learning method for botnet identification that makes use of statistically determined network flow data that are acquired by using DNN [27]. The study's astounding 99% accuracy rate attested to the efficacy of this strategy.…”

Section: Literature Reviewmentioning

confidence: 99%

“…The authors in [27] recommended a deep learning approach for identifying botnets through the usage of DNN-obtained statistical network flow data. The model offers a 99% level of accuracy.…”

Section: Literature Reviewmentioning

confidence: 99%

“…Typically, quadratic programming approaches tackle optimization, which entails minimizing a quadratic objective function while adhering to linear constraints. The best solution to the Lagrange dual issue may also be determined, leading to the construction of the SVM as a linear combination of support vectors [27], as in Equation ( 13):…”

Section: Svmmentioning

confidence: 99%

See 2 more Smart Citations

A Hybrid Optimization Model for Efficient Detection and Classification of Malware in the Internet of Things

Ahmad,

Wan,

Ahmad

et al. 2024

Mathematics

View full text Add to dashboard Cite

The proliferation of Internet of Things (IoT) devices and their integration into critical infrastructure and business operations has rendered them susceptible to malware and cyber-attacks. Such malware presents a threat to the availability and reliability of IoT devices, and a failure to address it can have far-reaching impacts. Due to the limited resources of IoT devices, traditional rule-based detection systems are often ineffective against sophisticated attackers. This paper addressed these issues by designing a new framework that uses a machine learning (ML) algorithm for the detection of malware. Additionally, it also employed sequential detection architecture and evaluated eight malware datasets. The design framework is lightweight and effective in data processing and feature selection algorithms. Moreover, this work proposed a classification model that utilizes one support vector machine (SVM) algorithm and is individually tuned with three different optimization algorithms. The employed optimization algorithms are Nuclear Reactor Optimization (NRO), Artificial Rabbits Optimization (ARO), and Particle Swarm Optimization (PSO). These algorithms are used to explore a diverse search space and ensure robustness in optimizing the SVM for malware detection. After extensive simulations, our proposed framework achieved the desired accuracy among eleven existing ML algorithms and three proposed ensemblers (i.e., NRO_SVM, ARO_SVM, and PSO_SVM). Among all algorithms, NRO_SVM outperforms the others with an accuracy rate of 97.8%, an F1 score of 97%, and a recall of 99%, and has fewer false positives and false negatives. In addition, our model successfully identified and prevented malware-induced attacks with a high probability of recognizing new evolving threats.

show abstract

Section: Literature Reviewmentioning

confidence: 99%

“…The authors in [27] recommended a deep learning approach for identifying botnets through the usage of DNN-obtained statistical network flow data. The model offers a 99% level of accuracy.…”

Section: Literature Reviewmentioning

confidence: 99%

See 1 more Smart Citation

A Hybrid Optimization Model for Efficient Detection and Classification of Malware in the Internet of Things

Ahmad,

Wan,

Ahmad

et al. 2024

Mathematics

View full text Add to dashboard Cite

show abstract

“…In static analysis, the malware features are extracted from the malware binary file (the PE file) [14][15][16][17][18]. Meanwhile, in dynamic analysis, the malware features are extracted during the runtime in an isolated analysis environment [14,[19][20][21][22][23][24][25][26][27][28][29][30][31][32][33]. Some studies hybridize the features from dynamic and static analysis to improve detectability [5,9,12,26,34].…”

Section: Related Workmentioning

confidence: 99%

Similarity-Based Hybrid Malware Detection Model Using API Calls

Alhashmi,

Darem,

Alashjaee

et al. 2023

Mathematics

View full text Add to dashboard Cite

This study presents a novel Similarity-Based Hybrid API Malware Detection Model (HAPI-MDM) aiming to enhance the accuracy of malware detection by leveraging the combined strengths of static and dynamic analysis of API calls. Faced with the pervasive challenge of obfuscation techniques used by malware authors, the conventional detection models often struggle to maintain robust performance. Our proposed model addresses this issue by deploying a two-stage learning approach where the XGBoost algorithm acts as a feature extractor feeding into an Artificial Neural Network (ANN). The key innovation of HAPI-MDM is the similarity-based feature, which further enhances the detection accuracy of the dynamic analysis, ensuring reliable detection even in the presence of obfuscation. The model was evaluated using seven machine learning techniques with 10 K-fold cross-validation. Experimental results demonstrated HAPI-MDM’s superior performance, achieving an overall accuracy of 97.91% and the lowest false-positive and false-negative rates compared to related works. The findings suggest that integrating dynamic and static API-based features and utilizing a similarity-based feature significantly improves malware detection performance, thereby offering an effective tool to fortify cybersecurity measures against escalating malware threats.

show abstract

“…This ensemble learning method leverages the strengths of various models, thereby improving the overall performance and robustness of the system. In the context of malware analysis, Ensemble methods can enhance the accuracy and reliability of malware detection [5]. On the other hand, dendrogram visualization is a technique used in hierarchical clustering which groups similar families [6].…”

Section: Introductionmentioning

confidence: 99%

A Robust Method for Malware Analysis Using Stacking Classifiers and Dendrogram Visualization

Nallabala

2024

Preprint

View full text Add to dashboard Cite

Malware analysis is a vital and challenging task in the ever-changing cyber threat landscape. Traditional signature-based methods cannot keep up with the fast-paced evolution of malware variants. This underscores the need for developing a more effective malware classification tool helping in exploring new research directions with solutions. In this research work firstly, we present a comprehensive assessment on malware classification using dendrogram clustering techniques. This work proposes, a robust approach to malware analysis by constructing dendrogram that groups malware samples which works based on their ancestral relationships. Semantic analysis of the code also provides deeper insights into the malware’s behavior and functionality, enabling more precise identification. These methods help to detect new variants as well as enhance the recognition of existing malware families. Our proposed model results shows that, the robustness in accuracy and False Positive Rate when compared with other existing models.

show abstract

Performance evaluation of various ensemble classifiers for malware detection

Cited by 8 publications

References 20 publications

A Hybrid Optimization Model for Efficient Detection and Classification of Malware in the Internet of Things

A Hybrid Optimization Model for Efficient Detection and Classification of Malware in the Internet of Things

Similarity-Based Hybrid Malware Detection Model Using API Calls

A Robust Method for Malware Analysis Using Stacking Classifiers and Dendrogram Visualization

Contact Info

Product

Resources

About