Malware Detection Using Memory Analysis Data in Big Data Environment
Source abstract
Abstract
Malware is a significant threat that has grown with the spread of technology. This makes detecting malware a critical issue. Static and dynamic methods are widely used in the detection of malware. However, traditional static and dynamic malware detection methods may fall short in advanced malware detection. Data obtained through memory analysis can provide important insights into the behavior and patterns of malware. This is because malwares leave various traces on memories. For this reason, the memory analysis method is one of the issues that should be studied in malware detection. In this study, the use of memory data in malware detection is suggested. Malware detection was carried out by using various deep learning and machine learning approaches in a big data environment with memory data. This study was carried out with Pyspark on Apache Spark big data platform in Google Colaboratory. Experiments were performed on the balanced CIC-MalMem-2022 dataset. Binary classification was made using Random Forest, Decision Tree, Gradient Boosted Tree, Logistic Regression, Naive Bayes, Linear Vector Support Machine, Multilayer Perceptron, Deep Feed Forward Neural Network, and Long Short-Term Memory algorithms. The performances of the algorithms used have been compared. The results were evaluated using the Accuracy, F1-score, Precision, Recall, and AUC performance metrics. As a result, the most successful malware detection was obtained with the Logistic Regression algorithm, with an accuracy level of 99.97% in malware detection by memory analysis. Gradient Boosted Tree follows the Logistic Regression algorithm with 99.94% accuracy. The Naive Bayes algorithm showed the lowest performance in malware analysis with memory data, with an accuracy of 98.41%. In addition, many of the algorithms used have achieved very successful results. According to the results obtained, the data obtained from memory analysis is very useful in detecting malware. In addition, deep learning and machine learning approaches were trained with memory datasets and achieved very successful results in malware detection.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Anomaly Detection Techniques and Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Information Security Engineering, Graduate School of Natural and Applied Sciences, Gazi University, 06560 Ankara, Turkey
Department of Computer Technologies, Vocational School of Technical Sciences, Ankara Yıldırım Beyazıt University, 06760 Ankara, Turkey
References (48)
Show source-provided references
1. (2022, May 17). AV-Test Institute. Available online: https://www.av-test.org/en/statistics/malware/.
2. Imaging and evaluating the memory access for malware
3. Banin, S., and Dyrkolbotn, G.O. (2020, January 10–13). Detection of Previously Unseen Malware Using Memory Access Patterns Recorded before the Entry Point. Proceedings of the 2020 IEEE International Conference on Big Data (Big Data), Atlanta, GA, USA.10.1109/BigData50022.2020.9377933 ↗
4. A Survey on Malware Analysis Techniques: Static, Dynamic, Hybrid and Memory Analysis10.18517/ijaseit.8.4-2.6827 ↗
5. Mosli, R.N., Li, R., Yuan, B., and Pan, Y. (2016, January 10–11). Automated malware detection using artifacts in forensic memory images. Proceedings of the 2016 IEEE Symposium on Technologies for Homeland Security (HST), Waltham, MA, USA.10.1109/THS.2016.7568881 ↗
6. Rathnayaka, C., and Jamdagni, A. (2017, January 1–4). An Efficient Approach for Advanced Malware Analysis Using Memory Forensic Technique. Proceedings of the 2017 IEEE Trustcom/BigDataSE/ICESS, Sydney, NSW, Australia.10.1109/Trustcom/BigDataSE/ICESS.2017.365 ↗
7. An Effective Memory Analysis for Malware Detection and Classification
8. Sihwail, R., Omar, K., Ariffin, K.A.Z., and Al Afghani, S. (2019). Malware Detection Approach Based on Artifacts in Memory Image and Dynamic Analysis. Appl. Sci., 9.10.3390/app9183680 ↗
9. Survey of machine learning techniques for malware analysis10.1016/j.cose.2018.11.001 ↗
10. Aghaeikheirabady, M., Farshchi, S.M.R., and Shirazi, H. (2014, January 26–27). A New Approach to Malware Detection by Comparative Analysis of Data Structures in a Memory Image. Proceedings of the 2014 International Congress on Technology, Communication and Knowledge (ICTCK), Mashhad, Iran.10.1109/ICTCK.2014.7033519 ↗
11. AMAL: High-fidelity, behavior-based automated malware analysis and classification10.1016/j.cose.2015.04.001 ↗
12. Ahmadi, M., Ulyanov, D., Semenov, S., Trofimov, M., and Giacinto, G. (2016, January 9–11). Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification. Proceedings of the Codaspy’16: Proceedings of the Sixth Acm Conference on Data and Application Security and Privacy, New Orleans, LA, USA.10.1145/2857705.2857713 ↗
13. Leveraging virtual machine introspection with memory forensics to detect and characterize unknown malware using machine learning techniques at hypervisor10.1016/j.diin.2017.10.004 ↗
14. A Behavior-Based Approach for Malware Detection
15. Petrik, R., Arik, B., and Smith, J.M. (2018, January 15–19). Towards Architecture and OS-Independent Malware Detection via Memory Forensics. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (Ccs’18), Toronto, ON, Canada.10.1145/3243734.3278527 ↗
16. Volatile memory analysis using the MinHash method for efficient and secured detection of malware in private cloud10.1016/j.cose.2019.101590 ↗
17. Lashkari, A.H., Li, B., Carrier, T.L., and Kaur, G. (2021, January 18–19). VolMemLyzer: Volatile Memory Analyzer for Malware Classification Using Feature Engineering. Proceedings of the 2021 Reconciling Data Analytics, Automation, Privacy, and Security: A Big Data Challenge (RDAAPS), Hamilton, ON, Canada.10.1109/RDAAPS48126.2021.9452028 ↗
18. MALREC: Compact Full-Trace Malware Recording for Retrospective Deep Analysis10.1007/978-3-319-93411-2_1 ↗
19. Long short-term memory-based Malware classification method for information security10.1016/j.compeleceng.2019.06.014 ↗
20. Safa, H., Nassar, M., and Al Orabi, W.A. (2019, January 24–28). Benchmarking Convolutional and Recurrent Neural Networks for Malware Classification. Proceedings of the 2019 15th International Wireless Communications & Mobile Computing Conference (IWCMC), Tangier, Morocco.10.1109/IWCMC.2019.8766515 ↗
21. ASSCA: API sequence and statistics features combined architecture for malware detection10.1016/j.comnet.2019.04.007 ↗
22. Malware classification algorithm using advanced Word2vec-based Bi-LSTM for ground control stations10.1016/j.comcom.2020.02.005 ↗
23. Leveraging malicious behavior traces from volatile memory using machine learning methods for trusted unknown malware detection in Linux cloud environments10.1016/j.knosys.2021.107095 ↗
24. Diaz, J.A., and Bandala, A. (2021, January 7–10). Portable Executable Malware Classifier Using Long Short Term Memory and Sophos-ReversingLabs 20 Million Dataset. Proceedings of the TENCON 2021—2021 IEEE Region 10 Conference (TENCON), Auckland, New Zealand.10.1109/TENCON54134.2021.9707353 ↗
25. Malicious code classification based on opcode sequences and textCNN network
26. Process based volatile memory forensics for ransomware detection10.1002/cpe.6672 ↗
27. Rezende, E., Ruppert, G., Carvalho, T., Ramos, F., and de Geus, P. (2017, January 18–21). Malicious Software Classification using Transfer Learning of ResNet-50 Deep Neural Network. Proceedings of the 2017 16th IEEE International Conference on Machine Learning and Applications (ICMLA), Cancun, Mexico.10.1109/ICMLA.2017.00-19 ↗
28. Malware identification using visualization images and deep learning10.1016/j.cose.2018.04.005 ↗
29. A malware classification method based on memory dump grayscale image10.1016/j.diin.2018.09.006 ↗
30. Li, H.H., Zhan, D.Y., Liu, T.R., and Ye, L. (2019, January 4–7). Using Deep-Learning-Based Memory Analysis for Malware Detection in Cloud. Proceedings of the 2019 IEEE 16th International Conference on Mobile Ad Hoc and Sensor Systems Workshops (MASSW), Monterey, CA, USA.10.1109/MASSW.2019.00008 ↗
31. SMASH: A Malware Detection Method Based on Multi-Feature Ensemble Learning10.1109/ACCESS.2019.2934012 ↗
32. Vision-Based Malware Detection: A Transfer Learning Approach Using Optimal ECOC-SVM Configuration10.1109/ACCESS.2021.3131713 ↗
33. Catch them alive: A malware detection approach through memory forensics, manifold learning and computer vision10.1016/j.cose.2020.102166 ↗
34. Hemalatha, J., Roseline, S.A., Geetha, S., Kadry, S., and Damasevicius, R. (2021). An Efficient DenseNet-Based Deep Learning Model for Malware Detection. Entropy, 23.10.3390/e23030344 ↗
35. A novel malware classification and augmentation model based on convolutional neural network10.1016/j.cose.2021.102515 ↗
36. Awan, M.J., Masood, O.A., Mohammed, M.A., Yasin, A., Zain, A.M., Damaševičius, R., and Abdulkareem, K.H. (2021). Image-Based Malware Classification Using VGG19 Network and Spatial Convolutional Attention. Electronics, 10.10.3390/electronics10192444 ↗
37. EfficientNet convolutional neural networks-based Android malware detection10.1016/j.cose.2022.102622 ↗
38. Damaševičius, R., Venčkauskas, A., Toldinas, J., and Grigaliūnas, Š. (2021). Ensemble-Based Classification Using Neural Networks and Machine Learning Models for Windows PE Malware Detection. Electronics, 10.10.3390/electronics10040485 ↗
39. Azeez, N.A., Odufuwa, O.E., Misra, S., Oluranti, J., and Damaševičius, R. (2021). Windows PE Malware Detection Using Ensemble Learning. Informatics., 8.10.3390/informatics8010010 ↗
40. Kim, D., and Solomon, M.G. (2016). Fundamentals of Information Systems Security, Jones & Bartlett Learning.
41. Grammatikakis, K.P., Koufos, I., Kolokotronis, N., Vassilakis, C., and Shiaeles, S. (2021, January 26–28). Understanding and Mitigating Banking Trojans: From Zeus to Emotet. Proceedings of the 2021 IEEE International Conference on Cyber Security and Resilience (CSR), Rhodes, Greece.10.1109/CSR51186.2021.9527960 ↗
42. (2022, May 17). Apache Spark. Available online: https://spark.apache.org/.
43. (2022, May 17). Canadian Institute for Cybersecurity. Available online: https://www.unb.ca/cic/datasets/malmem-2022.html.
44. Carrier, T., Victor, P., Tekeoglu, A., and Lashkari, A. (2022, January 9–11). Detecting Obfuscated Malware using Memory Feature Engineering. Proceedings of the 8th International Conference on Information Systems Security and Privacy, Online Streaming.10.5220/0010908200003120 ↗
45. Han, J., Pei, J., and Kamber, M. (2011). Data Mining: Concepts and Techniques, Elsevier.
46. Improving malware detection using big data and ensemble learning10.1016/j.compeleceng.2020.106729 ↗
47. Tools & Techniques for Malware Analysis and Classification
48. Deep learning in bioinformatics