Similarity hash based scoring of portable executable files for efficient malware detection in IoT

Namanya, Anitta Patience; Awan, Irfan-Ullah; Disso, Jules Pagna; Younas, Muhammad

doi:10.1016/j.future.2019.04.044

Cited by 43 publications

(24 citation statements)

References 19 publications

(24 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It can be used as a data augmentation technique to generate high quality synthetic samples. Paper [26] investigates into a central issue of how different hashing techniques can be combined to provide a quantitative malware score and to achieve better detection rates. They design and develop a novel approach for malware scoring based on the hashes results.…”

Section: Methods Based On Improvement Deep Learningmentioning

confidence: 99%

Deep Learning and Regularization Algorithms for Malicious Code Classification

et al. 2021

View full text Add to dashboard Cite

Network security has become a growing concern within the popularity and development of the Internet. Malicious code is one of the main threats in network security. Different types of malicious code have different functions and cause different harms. Therefore, improving the detection efficiency and recognition accuracy of malicious code is becoming an urgent problem to be solved. While traditional machine learning methods for malicious codes detection largely depend on hand-designed features with experts' knowledge of the domain, or focus on the images which comes from malicious code binary files. These methods spend too much time on feature extraction. With the emergence of a large amount of malicious code data, efficiency of traditional machine learning algorithms is getting worse and worse. In this paper, a workflow based on deep learning is proposed to detect and classify malicious codes. This workflow adopts convolutional neural network (CNN) and the regularization algorithms to classify malicious code with N_gram semantic feature as input of the model. The convolutional neural network can automatically extract the features of malicious code, while avoiding the need for manual feature selection. Regularization algorithms not only speed up the training process of the deep model, but also improve the generalization ability in the case of effective prevention of over-fitting of the model. The proposed method is compared with the state-of-the art methods and other deep learning models. Experimental results show that our workflow is able to improve the accuracy and efficiency of malicious code classification.

show abstract

Section: Methods Based On Improvement Deep Learningmentioning

confidence: 99%

Deep Learning and Regularization Algorithms for Malicious Code Classification

et al. 2021

View full text Add to dashboard Cite

show abstract

“…Later, Term Frequency-Inverse Document Frequency (TF-IDF) and Information Gain (IG) were also applied as classification algorithms. In 2019, researcher [29] proposed a malware detection approach in the IoT environment based on similarity hashing algorithm-based. In proposed technique, scores of binaries were calculated to identify the similarity between malicious PEs.…”

Section: Related Workmentioning

confidence: 99%

PROUD-MAL: static analysis-based progressive framework for deep unsupervised malware classification of windows portable executable

Rizvi

Aslam

Shahzad

et al. 2021

Complex Intell. Syst.

View full text Add to dashboard Cite

Enterprises are striving to remain protected against malware-based cyber-attacks on their infrastructure, facilities, networks and systems. Static analysis is an effective approach to detect the malware, i.e., malicious Portable Executable (PE). It performs an in-depth analysis of PE files without executing, which is highly useful to minimize the risk of malicious PE contaminating the system. Yet, instant detection using static analysis has become very difficult due to the exponential rise in volume and variety of malware. The compelling need of early stage detection of malware-based attacks significantly motivates research inclination towards automated malware detection. The recent machine learning aided malware detection approaches using static analysis are mostly supervised. Supervised malware detection using static analysis requires manual labelling and human feedback; therefore, it is less effective in rapidly evolutionary and dynamic threat space. To this end, we propose a progressive deep unsupervised framework with feature attention block for static analysis-based malware detection (PROUD-MAL). The framework is based on cascading blocks of unsupervised clustering and features attention-based deep neural network. The proposed deep neural network embedded with feature attention block is trained on the pseudo labels. To evaluate the proposed unsupervised framework, we collected a real-time malware dataset by deploying low and high interaction honeypots on an enterprise organizational network. Moreover, endpoint security solution is also deployed on an enterprise organizational network to collect malware samples. After post processing and cleaning, the novel dataset consists of 15,457 PE samples comprising 8775 malicious and 6681 benign ones. The proposed PROUD-MAL framework achieved an accuracy of more than 98.09% with better quantitative performance in standard evaluation parameters on collected dataset and outperformed other conventional machine learning algorithms. The implementation and dataset are available at https://bit.ly/35Sne3a.

show abstract

“…In the present study, 10 different marble images, namely Afyon Violet, Barred Marmara, Burdur Coffee, Bursa Dark Beige, Diana Rose, Ege Cofee, Burdur Coffee, Karacabey Black, Toros Black, and Tundra Gray, were classified. The classification performance was evaluated using accuracy, F1score, recall, precision, false-positive, and receiver operating [30][31][32].…”

Section: Metricsmentioning

confidence: 99%

An Effective Turkey Marble Classification System: Convolutional Neural Network with Genetic Algorithm -Wavelet Kernel - Extreme Learning Machine

Avcı¹,

Sert²

2021

View full text Add to dashboard Cite

Marble is one of the most popular decorative elements. Marble quality varies depending on its vein patterns and color, which are the two most important factors affecting marble quality and class. The manual classification of marbles is likely to lead to various mistakes due to different optical illusions. However, computer vision minimizes these mistakes thanks to artificial intelligence and machine learning. The present study proposes the Convolutional Neural Network- (CNN-) with genetic algorithm- (GA) Wavelet Kernel- (WK-) Extreme Learning Machine (ELM) (CNN–GA-WK-ELM) approach. Using CNN architectures such as AlexNet, VGG-19, SqueezeNet, and ResNet-50, the proposed approach obtained 4 different feature vectors from 10 different marble images. Later, Genetic Algorithm (GA) was used to optimize adjustable parameters, i.e. k, 1, and m, and hidden layer neuron number in Wavelet Kernel (WK) – Extreme Learning Machine (ELM) and to increase the performance of ELM. Finally, 4 different feature vector parameters were optimized and classified using the WK-ELM classifier. The proposed CNN–GA-WK-ELM yielded an accuracy rate of 98.20%, 96.40%, 96.20%, and 95.60% using AlexNet, SequeezeNet, VGG-19, and ResNet-50, respectively.

show abstract

Similarity hash based scoring of portable executable files for efficient malware detection in IoT

Cited by 43 publications

References 19 publications

Deep Learning and Regularization Algorithms for Malicious Code Classification

Deep Learning and Regularization Algorithms for Malicious Code Classification

PROUD-MAL: static analysis-based progressive framework for deep unsupervised malware classification of windows portable executable

An Effective Turkey Marble Classification System: Convolutional Neural Network with Genetic Algorithm -Wavelet Kernel - Extreme Learning Machine

Contact Info

Product

Resources

About