Cargando…
An Insight into the Machine-Learning-Based Fileless Malware Detection
In recent years, massive development in the malware industry changed the entire landscape for malware development. Therefore, cybercriminals became more sophisticated by advancing their development techniques from file-based to fileless malware. As file-based malware depends on files to spread itsel...
Autores principales: | , , , , , , , |
---|---|
Formato: | Online Artículo Texto |
Lenguaje: | English |
Publicado: |
MDPI
2023
|
Materias: | |
Acceso en línea: | https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9861630/ https://www.ncbi.nlm.nih.gov/pubmed/36679406 http://dx.doi.org/10.3390/s23020612 |
_version_ | 1784874889861136384 |
---|---|
author | Khalid, Osama Ullah, Subhan Ahmad, Tahir Saeed, Saqib Alabbad, Dina A. Aslam, Mudassar Buriro, Attaullah Ahmad, Rizwan |
author_facet | Khalid, Osama Ullah, Subhan Ahmad, Tahir Saeed, Saqib Alabbad, Dina A. Aslam, Mudassar Buriro, Attaullah Ahmad, Rizwan |
author_sort | Khalid, Osama |
collection | PubMed |
description | In recent years, massive development in the malware industry changed the entire landscape for malware development. Therefore, cybercriminals became more sophisticated by advancing their development techniques from file-based to fileless malware. As file-based malware depends on files to spread itself, on the other hand, fileless malware does not require a traditional file system and uses benign processes to carry out its malicious intent. Therefore, it evades conventional detection techniques and remains stealthy. This paper briefly explains fileless malware, its life cycle, and its infection chain. Moreover, it proposes a detection technique based on feature analysis using machine learning for fileless malware detection. The virtual machine acquired the memory dumps upon executing the malicious and non-malicious samples. Then the necessary features are extracted using the Volatility memory forensics tool, which is then analyzed using machine learning classification algorithms. After that, the best algorithm is selected based on the k-fold cross-validation score. Experimental evaluation has shown that Random Forest outperforms other machine learning classifiers (Decision Tree, Support Vector Machine, Logistic Regression, K-Nearest Neighbor, XGBoost, and Gradient Boosting). It achieved an overall accuracy of 93.33% with a True Positive Rate (TPR) of 87.5% at zeroFalse Positive Rate (FPR) for fileless malware collected from five widely used datasets (VirusShare, AnyRun, PolySwarm, HatchingTriage, and JoESadbox). |
format | Online Article Text |
id | pubmed-9861630 |
institution | National Center for Biotechnology Information |
language | English |
publishDate | 2023 |
publisher | MDPI |
record_format | MEDLINE/PubMed |
spelling | pubmed-98616302023-01-22 An Insight into the Machine-Learning-Based Fileless Malware Detection Khalid, Osama Ullah, Subhan Ahmad, Tahir Saeed, Saqib Alabbad, Dina A. Aslam, Mudassar Buriro, Attaullah Ahmad, Rizwan Sensors (Basel) Article In recent years, massive development in the malware industry changed the entire landscape for malware development. Therefore, cybercriminals became more sophisticated by advancing their development techniques from file-based to fileless malware. As file-based malware depends on files to spread itself, on the other hand, fileless malware does not require a traditional file system and uses benign processes to carry out its malicious intent. Therefore, it evades conventional detection techniques and remains stealthy. This paper briefly explains fileless malware, its life cycle, and its infection chain. Moreover, it proposes a detection technique based on feature analysis using machine learning for fileless malware detection. The virtual machine acquired the memory dumps upon executing the malicious and non-malicious samples. Then the necessary features are extracted using the Volatility memory forensics tool, which is then analyzed using machine learning classification algorithms. After that, the best algorithm is selected based on the k-fold cross-validation score. Experimental evaluation has shown that Random Forest outperforms other machine learning classifiers (Decision Tree, Support Vector Machine, Logistic Regression, K-Nearest Neighbor, XGBoost, and Gradient Boosting). It achieved an overall accuracy of 93.33% with a True Positive Rate (TPR) of 87.5% at zeroFalse Positive Rate (FPR) for fileless malware collected from five widely used datasets (VirusShare, AnyRun, PolySwarm, HatchingTriage, and JoESadbox). MDPI 2023-01-05 /pmc/articles/PMC9861630/ /pubmed/36679406 http://dx.doi.org/10.3390/s23020612 Text en © 2023 by the authors. https://creativecommons.org/licenses/by/4.0/Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/). |
spellingShingle | Article Khalid, Osama Ullah, Subhan Ahmad, Tahir Saeed, Saqib Alabbad, Dina A. Aslam, Mudassar Buriro, Attaullah Ahmad, Rizwan An Insight into the Machine-Learning-Based Fileless Malware Detection |
title | An Insight into the Machine-Learning-Based Fileless Malware Detection |
title_full | An Insight into the Machine-Learning-Based Fileless Malware Detection |
title_fullStr | An Insight into the Machine-Learning-Based Fileless Malware Detection |
title_full_unstemmed | An Insight into the Machine-Learning-Based Fileless Malware Detection |
title_short | An Insight into the Machine-Learning-Based Fileless Malware Detection |
title_sort | insight into the machine-learning-based fileless malware detection |
topic | Article |
url | https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9861630/ https://www.ncbi.nlm.nih.gov/pubmed/36679406 http://dx.doi.org/10.3390/s23020612 |
work_keys_str_mv | AT khalidosama aninsightintothemachinelearningbasedfilelessmalwaredetection AT ullahsubhan aninsightintothemachinelearningbasedfilelessmalwaredetection AT ahmadtahir aninsightintothemachinelearningbasedfilelessmalwaredetection AT saeedsaqib aninsightintothemachinelearningbasedfilelessmalwaredetection AT alabbaddinaa aninsightintothemachinelearningbasedfilelessmalwaredetection AT aslammudassar aninsightintothemachinelearningbasedfilelessmalwaredetection AT buriroattaullah aninsightintothemachinelearningbasedfilelessmalwaredetection AT ahmadrizwan aninsightintothemachinelearningbasedfilelessmalwaredetection AT khalidosama insightintothemachinelearningbasedfilelessmalwaredetection AT ullahsubhan insightintothemachinelearningbasedfilelessmalwaredetection AT ahmadtahir insightintothemachinelearningbasedfilelessmalwaredetection AT saeedsaqib insightintothemachinelearningbasedfilelessmalwaredetection AT alabbaddinaa insightintothemachinelearningbasedfilelessmalwaredetection AT aslammudassar insightintothemachinelearningbasedfilelessmalwaredetection AT buriroattaullah insightintothemachinelearningbasedfilelessmalwaredetection AT ahmadrizwan insightintothemachinelearningbasedfilelessmalwaredetection |