检索结果-南通市图书馆

Analysis of Feature Importance and Interpretation for malware classification

同方期刊数据库评论

在线全文

同方期刊数据库

学校读者我要写书评

暂无评论

Computers, Materials & Continua 2020年第12期65卷 1891-1904页

作者： Dong-Wook Kim Gun-Yoon Shin Myung-Mook Han Department of Computer Engineering Gachon UniversitySungnam-si13120Korea Department of Software Gachon UniversitySungnam-si13120Korea

This study was conducted to enable prompt classification of malware,which was becoming increasingly *** do this,we analyzed the important features of malware and the relative importance of selected features according to a learning model to assess how those important features were ***,the analysis features were extracted using Cuckoo Sandbox,an open-source malware analysis tool,then the features were divided into five categories using the extracted *** 804 extracted features were reduced by 70%after selecting only the most suitable ones for malware classification using a learning model-based feature selection method called the recursive feature ***,these important features were *** level of contribution from each one was assessed by the Random Forest classifier *** results showed that System call features were mostly *** the end,it was possible to accurately identify the malware type using only 36 to 76 features for each of the four types of malware with the most analysis samples *** were the Trojan,Adware,Downloader,and Backdoor malware.

关键词： Recursive feature elimination model interpretability feature importance malware classification

Transferable Features from 1D-Convolutional Network for Industrial malware classification

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Computer Modeling in Engineering & Sciences 2022年第2期130卷 1003-1016页

作者： LiweiWang Jiankun Sun Xiong Luo Xi Yang School of Computer and Communication Engineering University of Science and Technology BeijingBeijing100083China Beijing Key Laboratory of Knowledge Engineering for Materials Science Beijing100083China Shunde Graduate School University of Science and Technology BeijingFoshan528399China Beijing Intelligent Logistics System Collaborative Innovation Center Beijing101149China

With the development of information technology,malware threats to the industrial system have become an emergent issue,since various industrial infrastructures have been deeply integrated into our modern works and *** identify and classify new malware variants,different types of deep learning models have been widely explored ***,sufficient data is usually required to achieve a well-trained deep learning classifier with satisfactory generalization ***,in current practical applications,an ample supply of data is absent in most specific industrial malware detection *** learning as an effective approach can be used to alleviate the influence of the small sample size *** addition,it can also reuse the knowledge from pretrained models,which is beneficial to the real-time requirement in industrial malware *** this paper,we investigate the transferable features learned by a 1D-convolutional network and evaluate our proposed methods on 6 transfer learning *** experiment results show that 1D-convolutional architecture is effective to learn transferable features for malware classification,and indicate that transferring the first 2 layers of our proposed 1D-convolutional network is the most efficient way to reuse the learned features.

关键词： Transfer learning malware classification sequence data modeling convolutional network

Automatic malware classification and new malware detection using machine learning

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Frontiers of Information Technology & Electronic Engineering 2017年第9期18卷 1336-1347页

作者： Liu LIU Bao-sheng WANG Bo YU Qiu-xi ZHONG College of Computer National University of Defense Technology Changsha 410073 China

The explosive growth ofmalware variants poses a major threat to information security. Traditional anti-virus systems based on signatures fail to classify unknown malware into their corresponding families and to detect new kinds of malware pro- grams. Therefore, we propose a machine learning based malware analysis system, which is composed of three modules： data processing, decision making, and new malware detection. The data processing module deals with gray-scale images, Opcode n-gram, and import fimctions, which are employed to extract the features of the malware. The decision-making module uses the features to classify the malware and to identify suspicious malware. Finally, the detection module uses the shared nearest neighbor （SNN） clustering algorithm to discover new malware families. Our approach is evaluated on more than 20 000 malware instances, which were collected by Kingsoft, ESET NOD32, and Anubis. The results show that our system can effectively classify the un- known malware with a best accuracy of 98.9%, and successfully detects 86.7% of the new malware.

关键词： malware classification Machine learning n-gram Gray-scale image Feature extraction malware detection

A Survey of malware classification Methods Based on Data Flow Graph

维普期刊数据库

同方期刊数据库评论

在线全文

学校读者我要写书评

暂无评论

国际计算机前沿大会会议论文集 2022年第1期 80-93页

作者： Tingting Jiang Lingling Cui Zedong Lin Faming Lu Shandong University of Science and Technology Qingdao 266590Shandong China Shandong Water Conservancy Vocational College Weifang 276826ShandongChina

malware is emerging day by *** evade detection,many malware obfuscation techniques have *** detectionmethods based on data flow graphs have attracted much attention since they can deal with the obfuscation problem to a certain *** malware classification methods based on data flow graphs have been *** of them are based on userdefined features or graph similarity of data flow *** neural networks have also recently been used to implement malware classification *** paper provides an overview of current data flow graph-based malware classification *** respective advantages and disadvantages are summarized as *** addition,the future trend of the data flow graph-based malware classification method is analyzed,which is of great significance for promoting the development of malware detection technology.

关键词： malware detection malware classification Data flow graph Graph neural network

VMCTE:Visualization-Basedmalware classification Using Transfer and Ensemble Learning

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Computers, Materials & Continua 2023年第5期75卷 4445-4465页

作者： Zhiguo Chen Jiabing Cao Engineering Research Center of Digital Forensics Ministry of EducationNanjing University of Information Science and TechnologyNanjing210044China School of Computer and Software Nanjing University of Information Science and TechnologyNanjing210044China

The Corona Virus Disease 2019(COVID-19)effect has made telecommuting and remote learning the *** growing number of Internet-connected devices provides cyber attackers with more attack *** development of malware by criminals also incorporates a number of sophisticated obfuscation techniques,making it difficult to classify and detect malware using conventional ***,this paper proposes a novel visualization-based malware classification system using transfer and ensemble learning(VMCTE).VMCTE has a strong anti-interference *** if malware uses obfuscation,fuzzing,encryption,and other techniques to evade detection,it can be accurately classified into its corresponding malware *** traditional dynamic and static analysis techniques,VMCTE does not require either reverse engineering or the aid of domain expert *** proposed classification system combines three strong deep convolutional neural networks(ResNet50,MobilenetV1,and MobilenetV2)as feature extractors,lessens the dimension of the extracted features using principal component analysis,and employs a support vector machine to establish the classification *** semantic representations of malware images can be extracted using various convolutional neural network(CNN)architectures,obtaining higher-quality features than traditional *** fine-tuned and non-fine-tuned classification models based on transfer learning can greatly enhance the capacity to classify various families *** experimental findings on the Malimg dataset demonstrate that VMCTE can attain 99.64%,99.64%,99.66%,and 99.64%accuracy,F1-score,precision,and recall,respectively.

关键词： malware classification ensemble learning visualization transfer learning

Ransomware classification Framework Using the Behavioral Performance Visualization of Execution Objects

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Computers, Materials & Continua 2022年第8期72卷 3401-3424页

作者： Jun-Seob Kim Ki-Woong Park Department of Computer and Information Security and Convergence Engineering for Intelligent DroneSejong UniversitySeoul05006Korea

A ransomware attack that interrupted the operation of Colonial Pipeline(a large *** pipeline company),showed that security threats by malware have become serious enough to affect industries and social infrastructure rather than individuals *** agents and characteristics of attacks should be identified,and appropriate strategies should be established accordingly in order to respond to such *** this purpose,the first task that must be performed is malware *** creators are well aware of this and apply various concealment and avoidance techniques,making it difficult to classify *** study focuses on new features and classification techniques to overcome these *** propose a behavioral performance visualization method using utilization patterns of system resources,such as the central processing unit,memory,and input/output,that are commonly used in performance analysis or tuning of *** extracted the usage patterns of the system resources for ransomware to performbehavioral performance *** results of the classification performance evaluation using the visualization results indicate an accuracy of at least 98.94%with a 3.69%loss ***,we designed and implemented a framework to perform the entire process—from data extraction to behavioral performance visualization and classification performance measurement—that is expected to contribute to related studies in the future.

关键词： Behavioral performance visualization ransomware malware classification

Android malware Detection Using ResNet-50 Stacking

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Computers, Materials & Continua 2023年第2期74卷 3997-4014页

作者： Lojain Nahhas Marwan Albahar Abdullah Alammari Anca Jurcut Department of Computer Science Umm Al Qura UniversityP.O.Box 715MeccaSaudi Arabia Curriculums and Teaching Department Faculty of EducationUmm Al Qura UniversityP.O.Box 715MeccaSaudi Arabia School of Computer Science University College DublinBelfieldDublinIreland

There has been an increase in attacks on mobile devices,such as smartphones and tablets,due to their growing *** malware is one of the most dangerous threats,causing both security breaches and financial *** malware is likely to continue to evolve and proliferate to carry out a variety of cybercrimes on mobile *** malware specifically targets Android operating system as it has grown in *** rapid proliferation of Android malware apps poses a significant security risk to users,making static and manual analysis of malicious files ***,efficient identification and classification of Androidmalicious files is *** ConvolutionalNeuralNetwork(CNN)basedmethods have been proposed in this regard;however,there is still room for performance *** this work,we propose a transfer learning and stacking approach to efficiently detect the Android malware files by utilizing two wellknown machine learning models,ResNet-50 and Support Vector Machine(SVM).The proposed model is trained on the DREBIN dataset by transforming malicious APK files into grayscale *** model yields higher performance measures than state-of-the-art works on the DREBIN dataset,where the reported measures are accuracy,recall,precision,and F1 measures of 97.8%,95.8%,95.7%,and 95.7%,respectively.

关键词： Androidmalware convolutional neural network malware analysis malware classification image classification support vector machine

An Empirical Study on the Effectiveness of Adversarial Examples in malware Detection

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Computer Modeling in Engineering & Sciences 2024年第6期139卷 3535-3563页

作者： Younghoon Ban Myeonghyun Kim Haehyun Cho School of Software Soongsil UniversitySeoul06978Korea

Antivirus vendors and the research community employ Machine Learning(ML)or Deep Learning(DL)-based static analysis techniques for efficient identification of new threats,given the continual emergence of novel malware *** the other hand,numerous researchers have reported that Adversarial Examples(AEs),generated by manipulating previously detected malware,can successfully evade ML/DL-based *** antivirus systems,in particular,have been identified as vulnerable to such *** paper firstly focuses on conducting black-box attacks to circumvent ML/DL-based malware *** attack method utilizes seven different perturbations,including Overlay Append,Section Append,and Break Checksum,capitalizing on the ambiguities present in the PE format,as previously employed in evasion attack *** directly applying the perturbation techniques to PE binaries,our attack method eliminates the need to grapple with the problem-feature space dilemma,a persistent challenge in many evasion attack *** a black-box attack,our method can generate AEs that successfully evade both DL-based and ML-based ***,AEs generated by the attack method retain their executability and malicious behavior,eliminating the need for functionality *** thorogh evaluations,we confirmed that the attack method achieves an evasion rate of 65.6%against well-known ML-based malware detectors and can reach a remarkable 99%evasion rate against well-known DL-based malware ***,our AEs demonstrated the capability to bypass detection by 17%of vendors out of the 64 on VirusTotal(VT).In addition,we propose a defensive approach that utilizes Trend Locality Sensitive Hashing(TLSH)to construct a similarity-based defense *** several experiments on the approach,we verified that our defense model can effectively counter AEs generated by the perturbation *** conclusion,our defense model alleviates the limitation of the mos

关键词： malware classification machine learning adversarial examples evasion attack cybersecurity

On building machine learning pipelines for Android malware detection:a procedural survey of practices,challenges and opportunities

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Cybersecurity 2022年第4期5卷 19-55页

作者： Masoud Mehrabi Koushki Ibrahim AbuAlhaol Anandharaju Durai Raju Yang Zhou Ronnie Salvador Giagone Huang Shengqiang Huawei Technologies Canada Co. LtdVancouverCanada Huawei Technologies CanadaCo LtdOttawaCanada Simon FraserUniversity BurnabyVancouverCanada uawei Technologies Canada Co. LtdTorontoCanada.

As the smartphone market leader,Android has been a prominent target for malware *** number of malicious applications(apps)identified for it has increased continually over the past decade,creating an immense challenge for all parties *** market holders and researchers,in particular,the large number of samples has made manual malware detection unfeasible,leading to an influx of research that investigate Machine Learning(ML)approaches to automate this ***,while some of the proposed approaches achieve high performance,rapidly evolving Android malware has made them unable to maintain their accuracy over *** has created a need in the community to conduct further research,and build more flexible ML *** so,however,is currently hindered by a lack of systematic overview of the existing literature,to learn from and improve upon the existing *** survey papers often focus only on parts of the ML process(e.g,data collection or model deployment),while omitting other important stages,such as model evaluation and explanation.n this paper,we address this problem with a review of 42 highly-cited papers,spanning a decade of research(from 2011 to 2021).We introduce a novel procedural taxonomy of the published literature,covering how they have used ML algorithms,what features they have engineered,which dimensionality reduction techniques they have employed,what datasets they have employed for training,and what their evaluation and explanation strategies *** from this taxonomy,we also identify gaps in knowledge and provide ideas for improvement and future work.

关键词： Android Machine learning malware classification Smartphone security Survey Taxonomy