Dynamic Extraction of Initial Behavior for Evasive Malware Detection
Recently, malware has become more abundant and complex as the Internet has become more widely used in daily services. Achieving satisfactory accuracy in malware detection is a challenging task since malicious software exhibit non-relevant features when they change the performed behaviors as a result...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2023-01-01
|
| Series: | Mathematics |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2227-7390/11/2/416 |
| _version_ | 1797438991248654336 |
|---|---|
| author | Faitouri A. Aboaoja Anazida Zainal Abdullah Marish Ali Fuad A. Ghaleb Fawaz Jaber Alsolami Murad A. Rassam |
| author_facet | Faitouri A. Aboaoja Anazida Zainal Abdullah Marish Ali Fuad A. Ghaleb Fawaz Jaber Alsolami Murad A. Rassam |
| author_sort | Faitouri A. Aboaoja |
| collection | DOAJ |
| description | Recently, malware has become more abundant and complex as the Internet has become more widely used in daily services. Achieving satisfactory accuracy in malware detection is a challenging task since malicious software exhibit non-relevant features when they change the performed behaviors as a result of their awareness of the analysis environments. However, the existing solutions extract features from the entire collected data offered by malware during the run time. Accordingly, the actual malicious behaviors are hidden during the training, leading to a model trained using unrepresentative features. To this end, this study presents a feature extraction scheme based on the proposed dynamic initial evasion behaviors determination (DIEBD) technique to improve the performance of evasive malware detection. To effectively represent evasion behaviors, the collected behaviors are tracked by examining the entropy distributions of APIs-gram features using the box-whisker plot algorithm. A feature set suggested by the DIEBD-based feature extraction scheme is used to train machine learning algorithms to evaluate the proposed scheme. Our experiments’ outcomes on a dataset of benign and evasive malware samples show that the proposed scheme achieved an accuracy of 0.967, false positive rate of 0.040, and <i>F</i>1 of 0.975. |
| first_indexed | 2024-03-09T11:46:23Z |
| format | Article |
| id | doaj.art-4c0a4dc85ce941f1909bd0f3fefdfc84 |
| institution | Directory Open Access Journal |
| issn | 2227-7390 |
| language | English |
| last_indexed | 2024-03-09T11:46:23Z |
| publishDate | 2023-01-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Mathematics |
| spelling | doaj.art-4c0a4dc85ce941f1909bd0f3fefdfc842023-11-30T23:21:54ZengMDPI AGMathematics2227-73902023-01-0111241610.3390/math11020416Dynamic Extraction of Initial Behavior for Evasive Malware DetectionFaitouri A. Aboaoja0Anazida Zainal1Abdullah Marish Ali2Fuad A. Ghaleb3Fawaz Jaber Alsolami4Murad A. Rassam5Faculty of Computing, Universiti Teknologi Malaysia, Iskandar Puteri 81310, MalaysiaFaculty of Computing, Universiti Teknologi Malaysia, Iskandar Puteri 81310, MalaysiaDepartment of Computer Science, Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah 21589, Saudi ArabiaFaculty of Computing, Universiti Teknologi Malaysia, Iskandar Puteri 81310, MalaysiaDepartment of Computer Science, Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah 21589, Saudi ArabiaDepartment of Information Technology, College of Computer, Qassim University, Buraidah 51452, Saudi ArabiaRecently, malware has become more abundant and complex as the Internet has become more widely used in daily services. Achieving satisfactory accuracy in malware detection is a challenging task since malicious software exhibit non-relevant features when they change the performed behaviors as a result of their awareness of the analysis environments. However, the existing solutions extract features from the entire collected data offered by malware during the run time. Accordingly, the actual malicious behaviors are hidden during the training, leading to a model trained using unrepresentative features. To this end, this study presents a feature extraction scheme based on the proposed dynamic initial evasion behaviors determination (DIEBD) technique to improve the performance of evasive malware detection. To effectively represent evasion behaviors, the collected behaviors are tracked by examining the entropy distributions of APIs-gram features using the box-whisker plot algorithm. A feature set suggested by the DIEBD-based feature extraction scheme is used to train machine learning algorithms to evaluate the proposed scheme. Our experiments’ outcomes on a dataset of benign and evasive malware samples show that the proposed scheme achieved an accuracy of 0.967, false positive rate of 0.040, and <i>F</i>1 of 0.975.https://www.mdpi.com/2227-7390/11/2/416malware analysis approachesmachine learning-based malware detection modelsevasive malwarefeature extraction methodsbox-whisker plot algorithm |
| spellingShingle | Faitouri A. Aboaoja Anazida Zainal Abdullah Marish Ali Fuad A. Ghaleb Fawaz Jaber Alsolami Murad A. Rassam Dynamic Extraction of Initial Behavior for Evasive Malware Detection Mathematics malware analysis approaches machine learning-based malware detection models evasive malware feature extraction methods box-whisker plot algorithm |
| title | Dynamic Extraction of Initial Behavior for Evasive Malware Detection |
| title_full | Dynamic Extraction of Initial Behavior for Evasive Malware Detection |
| title_fullStr | Dynamic Extraction of Initial Behavior for Evasive Malware Detection |
| title_full_unstemmed | Dynamic Extraction of Initial Behavior for Evasive Malware Detection |
| title_short | Dynamic Extraction of Initial Behavior for Evasive Malware Detection |
| title_sort | dynamic extraction of initial behavior for evasive malware detection |
| topic | malware analysis approaches machine learning-based malware detection models evasive malware feature extraction methods box-whisker plot algorithm |
| url | https://www.mdpi.com/2227-7390/11/2/416 |
| work_keys_str_mv | AT faitouriaaboaoja dynamicextractionofinitialbehaviorforevasivemalwaredetection AT anazidazainal dynamicextractionofinitialbehaviorforevasivemalwaredetection AT abdullahmarishali dynamicextractionofinitialbehaviorforevasivemalwaredetection AT fuadaghaleb dynamicextractionofinitialbehaviorforevasivemalwaredetection AT fawazjaberalsolami dynamicextractionofinitialbehaviorforevasivemalwaredetection AT muradarassam dynamicextractionofinitialbehaviorforevasivemalwaredetection |