Cargando…

Memory Visualization-Based Malware Detection Technique

Advanced Persistent Threat is an attack campaign in which an intruder or team of intruders establishes a long-term presence on a network to mine sensitive data, which becomes more dangerous when combined with polymorphic malware. This type of malware is not only undetectable, but it also generates m...

Descripción completa

Detalles Bibliográficos
Autores principales: Shah, Syed Shakir Hameed, Jamil, Norziana, Khan, Atta ur Rehman
Formato: Online Artículo Texto
Lenguaje:English
Publicado: MDPI 2022
Materias:
Acceso en línea:https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9572858/
https://www.ncbi.nlm.nih.gov/pubmed/36236711
http://dx.doi.org/10.3390/s22197611
_version_ 1784810722002206720
author Shah, Syed Shakir Hameed
Jamil, Norziana
Khan, Atta ur Rehman
author_facet Shah, Syed Shakir Hameed
Jamil, Norziana
Khan, Atta ur Rehman
author_sort Shah, Syed Shakir Hameed
collection PubMed
description Advanced Persistent Threat is an attack campaign in which an intruder or team of intruders establishes a long-term presence on a network to mine sensitive data, which becomes more dangerous when combined with polymorphic malware. This type of malware is not only undetectable, but it also generates multiple variants of the same type of malware in the network and remains in the system’s main memory to avoid detection. Few researchers employ a visualization approach based on a computer’s memory to detect and classify various classes of malware. However, a preprocessing step of denoising the malware images was not considered, which results in an overfitting problem and prevents us from perfectly generalizing a model. In this paper, we introduce a new data engineering approach comprising two main stages: Denoising and Re-Dimensioning. The first aims at reducing or ideally removing the noise in the malware’s memory-based dump files’ transformed images. The latter further processes the cleaned image by compressing them to reduce their dimensionality. This is to avoid the overfitting issue and lower the variance, computing cost, and memory utilization. We then built our machine learning model that implements the new data engineering approach and the result shows that the performance metrics of 97.82% for accuracy, 97.66% for precision, 97.25% for recall, and 97.57% for f1-score are obtained. Our new data engineering approach and machine learning model outperform existing solutions by 0.83% accuracy, 0.30% precision, 1.67% recall, and 1.25% f1-score. In addition to that, the computational time and memory usage have also reduced significantly.
format Online
Article
Text
id pubmed-9572858
institution National Center for Biotechnology Information
language English
publishDate 2022
publisher MDPI
record_format MEDLINE/PubMed
spelling pubmed-95728582022-10-17 Memory Visualization-Based Malware Detection Technique Shah, Syed Shakir Hameed Jamil, Norziana Khan, Atta ur Rehman Sensors (Basel) Article Advanced Persistent Threat is an attack campaign in which an intruder or team of intruders establishes a long-term presence on a network to mine sensitive data, which becomes more dangerous when combined with polymorphic malware. This type of malware is not only undetectable, but it also generates multiple variants of the same type of malware in the network and remains in the system’s main memory to avoid detection. Few researchers employ a visualization approach based on a computer’s memory to detect and classify various classes of malware. However, a preprocessing step of denoising the malware images was not considered, which results in an overfitting problem and prevents us from perfectly generalizing a model. In this paper, we introduce a new data engineering approach comprising two main stages: Denoising and Re-Dimensioning. The first aims at reducing or ideally removing the noise in the malware’s memory-based dump files’ transformed images. The latter further processes the cleaned image by compressing them to reduce their dimensionality. This is to avoid the overfitting issue and lower the variance, computing cost, and memory utilization. We then built our machine learning model that implements the new data engineering approach and the result shows that the performance metrics of 97.82% for accuracy, 97.66% for precision, 97.25% for recall, and 97.57% for f1-score are obtained. Our new data engineering approach and machine learning model outperform existing solutions by 0.83% accuracy, 0.30% precision, 1.67% recall, and 1.25% f1-score. In addition to that, the computational time and memory usage have also reduced significantly. MDPI 2022-10-08 /pmc/articles/PMC9572858/ /pubmed/36236711 http://dx.doi.org/10.3390/s22197611 Text en © 2022 by the authors. https://creativecommons.org/licenses/by/4.0/Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
spellingShingle Article
Shah, Syed Shakir Hameed
Jamil, Norziana
Khan, Atta ur Rehman
Memory Visualization-Based Malware Detection Technique
title Memory Visualization-Based Malware Detection Technique
title_full Memory Visualization-Based Malware Detection Technique
title_fullStr Memory Visualization-Based Malware Detection Technique
title_full_unstemmed Memory Visualization-Based Malware Detection Technique
title_short Memory Visualization-Based Malware Detection Technique
title_sort memory visualization-based malware detection technique
topic Article
url https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9572858/
https://www.ncbi.nlm.nih.gov/pubmed/36236711
http://dx.doi.org/10.3390/s22197611
work_keys_str_mv AT shahsyedshakirhameed memoryvisualizationbasedmalwaredetectiontechnique
AT jamilnorziana memoryvisualizationbasedmalwaredetectiontechnique
AT khanattaurrehman memoryvisualizationbasedmalwaredetectiontechnique