Memory Visualization-Based Malware Detection Technique
Advanced Persistent Threat is an attack campaign in which an intruder or team of intruders establishes a long-term presence on a network to mine sensitive data, which becomes more dangerous when combined with polymorphic malware. This type of malware is not only undetectable, but it also generates m...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2022-10-01
|
| Series: | Sensors |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1424-8220/22/19/7611 |
| _version_ | 1827652961353859072 |
|---|---|
| author | Syed Shakir Hameed Shah Norziana Jamil Atta ur Rehman Khan |
| author_facet | Syed Shakir Hameed Shah Norziana Jamil Atta ur Rehman Khan |
| author_sort | Syed Shakir Hameed Shah |
| collection | DOAJ |
| description | Advanced Persistent Threat is an attack campaign in which an intruder or team of intruders establishes a long-term presence on a network to mine sensitive data, which becomes more dangerous when combined with polymorphic malware. This type of malware is not only undetectable, but it also generates multiple variants of the same type of malware in the network and remains in the system’s main memory to avoid detection. Few researchers employ a visualization approach based on a computer’s memory to detect and classify various classes of malware. However, a preprocessing step of denoising the malware images was not considered, which results in an overfitting problem and prevents us from perfectly generalizing a model. In this paper, we introduce a new data engineering approach comprising two main stages: Denoising and Re-Dimensioning. The first aims at reducing or ideally removing the noise in the malware’s memory-based dump files’ transformed images. The latter further processes the cleaned image by compressing them to reduce their dimensionality. This is to avoid the overfitting issue and lower the variance, computing cost, and memory utilization. We then built our machine learning model that implements the new data engineering approach and the result shows that the performance metrics of 97.82% for accuracy, 97.66% for precision, 97.25% for recall, and 97.57% for f1-score are obtained. Our new data engineering approach and machine learning model outperform existing solutions by 0.83% accuracy, 0.30% precision, 1.67% recall, and 1.25% f1-score. In addition to that, the computational time and memory usage have also reduced significantly. |
| first_indexed | 2024-03-09T21:10:22Z |
| format | Article |
| id | doaj.art-b2d36ab578d24f3e8fa17e9b4a0f85f1 |
| institution | Directory Open Access Journal |
| issn | 1424-8220 |
| language | English |
| last_indexed | 2024-03-09T21:10:22Z |
| publishDate | 2022-10-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Sensors |
| spelling | doaj.art-b2d36ab578d24f3e8fa17e9b4a0f85f12023-11-23T21:52:00ZengMDPI AGSensors1424-82202022-10-012219761110.3390/s22197611Memory Visualization-Based Malware Detection TechniqueSyed Shakir Hameed Shah0Norziana Jamil1Atta ur Rehman Khan2Institute of Energy Infrastructure, College of Computing and Informatics, Universiti Tenaga Nasional, Kajang 43000, MalaysiaInstitute of Energy Infrastructure, College of Computing and Informatics, Universiti Tenaga Nasional, Kajang 43000, MalaysiaCollege of Engineering and IT, Ajman University, Ajman 346, United Arab EmiratesAdvanced Persistent Threat is an attack campaign in which an intruder or team of intruders establishes a long-term presence on a network to mine sensitive data, which becomes more dangerous when combined with polymorphic malware. This type of malware is not only undetectable, but it also generates multiple variants of the same type of malware in the network and remains in the system’s main memory to avoid detection. Few researchers employ a visualization approach based on a computer’s memory to detect and classify various classes of malware. However, a preprocessing step of denoising the malware images was not considered, which results in an overfitting problem and prevents us from perfectly generalizing a model. In this paper, we introduce a new data engineering approach comprising two main stages: Denoising and Re-Dimensioning. The first aims at reducing or ideally removing the noise in the malware’s memory-based dump files’ transformed images. The latter further processes the cleaned image by compressing them to reduce their dimensionality. This is to avoid the overfitting issue and lower the variance, computing cost, and memory utilization. We then built our machine learning model that implements the new data engineering approach and the result shows that the performance metrics of 97.82% for accuracy, 97.66% for precision, 97.25% for recall, and 97.57% for f1-score are obtained. Our new data engineering approach and machine learning model outperform existing solutions by 0.83% accuracy, 0.30% precision, 1.67% recall, and 1.25% f1-score. In addition to that, the computational time and memory usage have also reduced significantly.https://www.mdpi.com/1424-8220/22/19/7611malware analysispolymorphic malwarememory analysismachine learningdenoising filterswavelet transform |
| spellingShingle | Syed Shakir Hameed Shah Norziana Jamil Atta ur Rehman Khan Memory Visualization-Based Malware Detection Technique Sensors malware analysis polymorphic malware memory analysis machine learning denoising filters wavelet transform |
| title | Memory Visualization-Based Malware Detection Technique |
| title_full | Memory Visualization-Based Malware Detection Technique |
| title_fullStr | Memory Visualization-Based Malware Detection Technique |
| title_full_unstemmed | Memory Visualization-Based Malware Detection Technique |
| title_short | Memory Visualization-Based Malware Detection Technique |
| title_sort | memory visualization based malware detection technique |
| topic | malware analysis polymorphic malware memory analysis machine learning denoising filters wavelet transform |
| url | https://www.mdpi.com/1424-8220/22/19/7611 |
| work_keys_str_mv | AT syedshakirhameedshah memoryvisualizationbasedmalwaredetectiontechnique AT norzianajamil memoryvisualizationbasedmalwaredetectiontechnique AT attaurrehmankhan memoryvisualizationbasedmalwaredetectiontechnique |