PROUD-MAL: static analysis-based progressive framework for deep unsupervised malware classification of windows portable executable

Rizvi, Syed Khurram Jah; Aslam, Warda; Shahzad, Muhammad; Saleem, Shahzad; Fraz, Muhammad Moazam

doi:10.1007/s40747-021-00560-1

Cited by 20 publications

(9 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A differential analysis of static and dynamic approach has shown that later provides more dynamic features but suffers from high resource consumption, run time overhead and failure to identify the real behavior of PE. 28 The proposed method is based upon static analysis, therefore relevant and progressive approaches are explained here. In research work, 29 Saxe et al used static features to train their proposed for classification of PE instances.…”

Section: Related Workmentioning

confidence: 99%

“…It is the extension of our previous effort. 28 This native and novel dataset has been made public for further utilization. A comprehensive experimental study on indigenously collected and public datasets is also performed.…”

Section: Conclusion and Future Directionmentioning

confidence: 99%

“…In dynamic analysis, 27 PE are executed in a sandbox environment to perform behavioral analysis. A differential analysis of static and dynamic approach has shown that later provides more dynamic features but suffers from high resource consumption, run time overhead and failure to identify the real behavior of PE 28 . The proposed method is based upon static analysis, therefore relevant and progressive approaches are explained here.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Robust malware clustering of windows portable executables using ensemble latent representation and distribution modeling

Rizvi

Fraz

2023

Concurrency and Computation

Self Cite

View full text Add to dashboard Cite

Summary Malware is a malicious program used for unauthorized access to organizational infrastructure and systems. To overcome challenges of exponential growth of malware, notable research has been made for unsupervised clustering of Windows‐based portable executable (PE). Nevertheless, to the best of our knowledge there has been no research for robust cluster prediction of Windows based PEs using static features. To this end, we proposed an ensemble neural network architecture for unsupervised feature learning and its distribution modeling for robust clustering of PE(s). The novel architecture is a cascaded formation of a deep autoencoder (AE) network and latent distribution modeling (LDM) network. The AE performs feature learning using latent representation and LDM performs the distribution modeling of latent representation using Gaussian approximation. An objective function is also devised for model optimization. The network adjusts the Gaussian components to optimize the distribution modeling. It also performs adjustments for data representations toward related Gaussian centers to make the model behave in adaptive manner. A novel malware dataset has also been collected by employing endpoint security management solution over enterprise network to assess proposed architecture. The dataset contains 21,486 samples including 14,497 malicious and 6989 benign ones. We also performed the evaluation of proposed architecture over publicly available benchmark malware dataset including 138,047 samples comprising 96,742 malicious and 41,323 benign PEs. The experimental results demonstrated that the proposed architecture yielded more than 95% accuracy for cluster prediction. The novel architecture has achieved superior performance and outperformed progressive techniques. The dataset along with implementation are accessible at http://bit.ly/3J6ZF8S.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Conclusion and Future Directionmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Robust malware clustering of windows portable executables using ensemble latent representation and distribution modeling

Rizvi

Fraz

2023

Concurrency and Computation

Self Cite

View full text Add to dashboard Cite

show abstract

“…File related features are not limited to but include a histogram of bytes in executable, the entropy of complete file entropy of various parts of files, strings embedded in the executable, N-grams [9] from byte code, N-grams from assembly code, N-grams from API calls, images of hex bytecode of a file [10] [11], images of hex bytecode of different part of a file, etc. Many machine learning models and deep learning models use features with different combinations derived from static analysis [12]. However, malware authors use methods such as obfuscation [13], encryption of various types to evade feature extraction methods.…”

Section: A Static Analysismentioning

confidence: 99%

Effective Malware Detection using Shapely Boosting Algorithm

Kumar¹,

Geetha²

2022

IJACSA

View full text Add to dashboard Cite

Malware constitutes a prime exploitation tool to attack the vulnerabilities in software that lead to a threat to security. The number of malware gets generated as exploitation tools need effective methods to detect them. Machine learning methods are effective in detecting malware. The effectiveness of machine learning models can be increased by analyzing how the features that build the model contribute to the detection of malware. The model can be made robust by getting insight into how features contribute to each sample that is fed to a trained model. In this paper, the boosting machine learning model based on LightGBM is enhanced with Shapley value to detect the contribution of the top nine features for classification such as true positive or true negative and for misclassification such as false positive or false negative. This insight in the model can be used for effective and robust malware detection and to avoid wrong detections such as false positive and false negative. The comparison of the top features and their contribution in shapely value for each category of the sample gives insight and inductive learning into the model to know the reasons for misclassification. Inductive learning can be transformed into rules. The prediction by the trained model can be re-evaluated with such inductive learning and rules to ensure effective and robust prediction and avoid misclassification. The performance of models gives 98.48 at maximum and 97.45 at a minimum by 10 fold cross-validation.

show abstract

“…In this method, the system monitors features of samples and tries to find malwares without running them. It is a technique for extracting features from an executable application, such as APIs,Permissions, hardware components and the Intent of the application [1]. These extracted features may be used alone or in combination to detect malware.…”

Section: A Malware Analysismentioning

confidence: 99%

Deep Image: A precious image based deep learning method for online malware detection in IoT Environment

Ghahramani¹,

Taheri²,

Shojafar³

et al. 2022

Preprint

View full text Add to dashboard Cite

The volume of malware and the number of attacks in IoT devices are rising everyday, which encourages security professionals to continually enhance their malware analysis tools. Researchers in the field of cyber security have extensively explored the usage of sophisticated analytics and the efficiency of malware detection. With the introduction of new malware kinds and attack routes, security experts confront considerable challenges in developing efficient malware detection and analysis solutions. In this paper, a different view of malware analysis is considered and the risk level of each sample feature is computed, and based on that the risk level of that sample is calculated. In this way, a criterion is introduced that is used together with accuracy and FPR criteria for malware analysis in IoT environment. In this paper, three malware detection methods based on visualization techniques called the clustering approach, the probabilistic approach, and the deep learning approach are proposed. Then, in addition to the usual machine learning criteria namely accuracy and FPR, a proposed criterion based on the risk of samples has also been used for comparison, with the results showing that the deep learning approach performed better in detecting malware.

show abstract

PROUD-MAL: static analysis-based progressive framework for deep unsupervised malware classification of windows portable executable

Cited by 20 publications

References 44 publications

Robust malware clustering of windows portable executables using ensemble latent representation and distribution modeling

Robust malware clustering of windows portable executables using ensemble latent representation and distribution modeling

Effective Malware Detection using Shapely Boosting Algorithm

Deep Image: A precious image based deep learning method for online malware detection in IoT Environment

Contact Info

Product

Resources

About