malware detection

Android-based mobile devices are widely used due to their ease of use among users. Individuals perform various tasks on their mobile phones, such as banking activities, social networking, and diverse business systems, thereby exposing considerable personal information to risks due to the vulnerabilities of the Android operating system. The rapid development of Android malware has rendered many traditional malware detection methods less accurate over time. Research indicates that machine learning is an effective approach for detecting malware. The rapid evolution of malware contributes to the degradation of accuracy in trained models over time. Moreover, the collection of malware-related data from Android devices jeopardizes users' privacy. To address these issue, this paper employs federated and incremental learning. Recently, federated learning has been introduced for training machine learning models on decentralized devices with the aim of preserving privacy. This study utilizes a Multi-Layer Perceptron (MLP) within the framework of federated learning. Stacking, a type of ensemble learning, is employed for incremental learning. The CICMalDroid 2020 dataset is utilized in this research, using static data to develop the final model. The outcome of this study is a model with an accuracy of 96.49%, demonstrating significant improvement in computational time complexity along with maintaining the quality of learning and model accuracy compared to existing methods.

With the explosive growth of threats to Internet security, malware visualization in malware classification has become a promising study area in security and machine learning. This paper proposes a visualization method for malware analysis based on word embedding features of byte sequences.Based on some assistant information such as word embedding, the basic to a strong malware classification approach is to transfer the learned information from the malware domain to the image domain, which needs correlation modeling between these domains. However, most current methods neglect to model the relationships in an embedding way, ensue in low performance of malware classification. To catch this challenge, we consider the Word Embeddings duty as a Semantic Information Extraction. Our Proposed method aims to learn effective representations of malware families, which takes as input a set of embedded vectors corresponding to the malware. Word embedding is designed to generate features of a malware sample by leveraging its malware semantics. Our results show that visual models in the domain of images can be used for efficient malware classification. We evaluated our method on the kaggle dataset of Windows PE file instances, obtaining an average classification accuracy of 0.9896%.

The growing number of malware is one of the major threats in the field of cyber and its detection has always been associated with challenges. Windows-based malicious executable files perform malicious activity at the target operating system level or any other application by manipulating features in their header and obscuring their behavior. Detecting suspicious specimens from a large volume of input samples as well as discovering new and unknown malware is one of the topics that is always researched by researchers. In this study, a combined method has been proposed to determine the level of maliciousness of suspicious executable files. Kashif's proposed method consists of two static modules for extracting executable file header properties, and two behavioral modules for extracting signature-generating properties and a thoughtful behavioral model based on machine learning methods. The purpose of this study is to identify suspicious Windows executable files from the large volume of files and determine their maliciousness level. This method detects malware based on the maliciousness probability of being assigned to each file. Experiments showed a malignancy percentage of six types of malware for PE header detector module, in the range of 62.7 to 70%, Yara-based detector module, in the range of 70.8 to 78.2%, Behavioral signature-based detector module, 98% and ML-based detector module by using Random forest learning algorithm has been 99% accuracy. The experimental results also showed that Kashef detected 94% of the protected malware with a 2% improvement compared to the results of 10 similar products. And with 98% detection of unprotected malware, there is a 5% improvement compared to the results of 10 similar products.

One of the most popular ways to detect malware is to find a match for malware file signature pattern in the malware signature database. The malware signature database is pre-extracted and is constantly updated. Checking the similarity of input data using the stored signatures causes storage problems and increases the calculation costs. In addition, the detection based on adapting the malware signature pattern fails when changing the malware code in polymorphic malware. In this paper, by combining the static analysis of executable file structure and the machine learning algorithms, an effective method for malware detection is presented. The data set for training and evaluation of the proposed method includes 36,567 samples of malware and 17295 benign files, and the malware is clustered in 7 families. The results show that the presented method is able to detect and cluster malware from benign files with an accuracy of more than 99% and a false positive rate less than 0.4%. The proposed method has very low processing overheads compared to similar methods and the average scanning time of executable files is 0.244 second.

This article study and compare malware families and malware detection methods and propose a new and efficient method for malware detection by static analysis. Proposed method based on PE Structure of executable files. Our method propose some new feathers such as quantity، name and size of sections، name of system calls and their libraries in IAT and EAT table، entry point and entropy for detection and distinguishes malwares and benign files by observing and exploring PE structure and header of mentioned files very deeply. These feathers can assign positive and negative point to determine malignant or benign rate of an unknown executable file by formulas of proposed method. We extract these features by doing data-mining on a large scale consist near 15000 malwares and 13500 benign files and used machine learning techniques for train and learn an intelligent rule base model for malware detection. Proposed method of this article cluster malwares in 5 and benign files in 2 families. This article evaluate accuracy of proposed method in detection and clustering malware and benign files and indicate that proposed method can detect and cluster malwares by more than 95 percent in accuracy and compete with other methods and get second ranked.