Redundancy Coefficient Gradual Up-weighting-based Mutual Information Feature Selection technique for Crypto-ransomware early detection

Al‐rimy, Bander Ali Saleh; Maarof, Mohd Aizaini; Alazab, Mamoun; Shaid, Syed Zainudeen Mohd; Ghaleb, Fuad A.; Almalawi, Abdulmohsen; Ali, Abdullah Marish; Al-Hadhrami, Tawfik

doi:10.1016/j.future.2020.10.002

Cited by 42 publications

(62 citation statements)

References 66 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…All the experiments in this study were carried out in a sandbox environment with host computer CPU Intel (R) Core i7 @ 3.20 GH, the RAM is 16.0 GB and the host operating system is Linux Ubuntu 18.04, and Windows 7 guest operating system was used as a victim machine. Sandboxes are tools that are commonly used by malware analysts and researchers to conduct dynamic analysis [36,37]. They provide a means of detecting windows APIs invoked by a malware instance at the run time in a process called API hooking and DLL injection [38].…”

Section: A Experimental Setupmentioning

confidence: 99%

“…The malware binary files were downloaded from the public repository Vxheaven (https://www.vxheaven.org). Vxheaven dataset is a public repository that is commonly-used by previous malware analysis studies such as in [14,36,37,[40][41][42]. The malware dataset contains different types of malware families such as trojans, adware, backdoors, ransomware, viruses, and worms among many others.…”

Section: B Dataset Descriptionmentioning

confidence: 99%

“…All malware files were scanned using VirusTotal service which is a popular malware scanning web service to confirm its class label and extract information related to its first occurring. VirusTotal uses 72 antivirus software and dynamic sandbox environment to scan the submitted files [36,37,43].…”

Section: B Dataset Descriptionmentioning

confidence: 99%

See 2 more Smart Citations

An Adaptive Behavioral-Based Incremental Batch Learning Malware Variants Detection Model Using Concept Drift Detection and Sequential Deep Learning

et al. 2021

Self Cite

View full text Add to dashboard Cite

Malware variants are the major emerging threats that face cybersecurity due to the potential damage to computer systems. Many solutions have been proposed for detecting malware variants. However, accurate detection is challenging due to the constantly evolving nature of the malware variants that cause concept drift. Existing malware detection solutions assume that the mapping learned from historical malware features will be valid for new and future malware. The relationship between input features and the class label has been considered stationary, which doesn't hold for the ever-evolving nature of malware variants. Malware features change dynamically due to code obfuscations, mutations, and the modification made by malware authors to change the features' distribution and thus evade the detection rendering the detection model obsolete and ineffective. This study presents an Adaptive behavioral-based Incremental Batch Learning Malware Variants Detection model using concept drift detection and sequential deep learning (AIBL-MVD) to accommodate the new malware variants. Malware behavior were extracted using dynamic analysis by running the malware files in a sandbox environment and collecting their Application Programming Interface (API) traces. According to the malware first-time appearance, the malware samples were sorted to capture the malware variants' change characteristics. The base classifier was then trained based on a subset of historical malware samples using a sequential deep learning model. The new malware samples were mixed with a subset of old data and gradually introduced to the learning model in an adaptive batch size incremental learning manner to address the catastrophic forgetting dilemma of the incremental learning. The statistical process control technique has been used to detect the concept drift as indication for incrementally updating the model as well as reducing the frequency of model updates. Results from extensive experiments show that the proposed model is superior in terms of detection rate and the efficiency compared with the static model, periodic retraining approaches, and the fixed batch size incremental learning approach. The model maintains an average of 99.41% detection accuracy of new and variants malware with a low updating frequency of 1.35 times per month.

show abstract

Section: A Experimental Setupmentioning

confidence: 99%

Section: B Dataset Descriptionmentioning

confidence: 99%

See 1 more Smart Citation

An Adaptive Behavioral-Based Incremental Batch Learning Malware Variants Detection Model Using Concept Drift Detection and Sequential Deep Learning

et al. 2021

Self Cite

View full text Add to dashboard Cite

show abstract

“…The efforts of security professionals and researches have converged to fight ransomware attacks [5,6]. They work side-by-side to detect, prevent, and mitigate such attacks and their potential effect.…”

Section: Introductionmentioning

confidence: 99%

A Survey of Crypto Ransomware Attack Detection Methodologies: An Evolving Outlook

Alqahtani

Sheldon

2022

Sensors

View full text Add to dashboard Cite

Recently, ransomware attacks have been among the major threats that target a wide range of Internet and mobile users throughout the world, especially critical cyber physical systems. Due to its unique characteristics, ransomware has attracted the attention of security professionals and researchers toward achieving safer and higher assurance systems that can effectively detect and prevent such attacks. The state-of-the-art crypto ransomware early detection models rely on specific data acquired during the runtime of an attack’s lifecycle. However, the evasive mechanisms that these attacks employ to avoid detection often nullify the solutions that are currently in place. More effort is needed to keep up with an attacks’ momentum to take the current security defenses to the next level. This survey is devoted to exploring and analyzing the state-of-the-art in ransomware attack detection toward facilitating the research community that endeavors to disrupt this very critical and escalating ransomware problem. The focus is on crypto ransomware as the most prevalent, destructive, and challenging variation. The approaches and open issues pertaining to ransomware detection modeling are reviewed to establish recommendations for future research directions and scope.

show abstract

“…Feature selection [ 1 – 5 ] differs from other data dimensionality reduction techniques (e.g., feature extraction) [ 6 ] in that feature selection focuses on analysing the relevance and redundancy in high-dimensional data, removing as many irrelevant and redundant features as possible and retaining the relevant original physical features. This approach not only improves the data quality and classification performance but also reduces the training time of the model and makes it more interpretable [ 7 – 9 ].…”

Section: Introductionmentioning

confidence: 99%

A Feature Selection Algorithm Integrating Maximum Classification Information and Minimum Interaction Feature Dependency Information

2021

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

Feature selection is the key step in the analysis of high-dimensional small sample data. The core of feature selection is to analyse and quantify the correlation between features and class labels and the redundancy between features. However, most of the existing feature selection algorithms only consider the classification contribution of individual features and ignore the influence of interfeature redundancy and correlation. Therefore, this paper proposes a feature selection algorithm for nonlinear dynamic conditional relevance (NDCRFS) through the study and analysis of the existing feature selection algorithm ideas and method. Firstly, redundancy and relevance between features and between features and class labels are discriminated by mutual information, conditional mutual information, and interactive mutual information. Secondly, the selected features and candidate features are dynamically weighted utilizing information gain factors. Finally, to evaluate the performance of this feature selection algorithm, NDCRFS was validated against 6 other feature selection algorithms on three classifiers, using 12 different data sets, for variability and classification metrics between the different algorithms. The experimental results show that the NDCRFS method can improve the quality of the feature subsets and obtain better classification results.

show abstract

Redundancy Coefficient Gradual Up-weighting-based Mutual Information Feature Selection technique for Crypto-ransomware early detection

Cited by 42 publications

References 66 publications

An Adaptive Behavioral-Based Incremental Batch Learning Malware Variants Detection Model Using Concept Drift Detection and Sequential Deep Learning

An Adaptive Behavioral-Based Incremental Batch Learning Malware Variants Detection Model Using Concept Drift Detection and Sequential Deep Learning

A Survey of Crypto Ransomware Attack Detection Methodologies: An Evolving Outlook

A Feature Selection Algorithm Integrating Maximum Classification Information and Minimum Interaction Feature Dependency Information

Contact Info

Product

Resources

About