A DBSCAN-based White-Hat Worm Launcher for Botnet Defense System

Pan, Xiangnan; Yamaguchi, Shingo

doi:10.1109/lifetech53646.2022.9754891

Cited by 1 publication

(1 citation statement)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As such, sequence information for significant actions is used as an important feature in detecting malware and intrusion. Methodologies such as hidden Markov model (HMM) [29]- [31], Markov chain [32]- [35], Petri nets [36]- [38] are used to detect malware and intrusions using sequence information for significant behaviors. The malware's behavior in the statetransition description method based on a probability model is used.…”

Section: ) Including Sequence Informationmentioning

confidence: 99%

HMLET: Hunt Malware Using Wavelet Transform on Cross-Platform

2022

View full text Add to dashboard Cite

As the importance of cyberspace grows, malicious software (malware) is threatening not only individuals but also countries. In addition, numerous malware is still circulating in cyberspace, and as technology advances, new or advanced malware are emerging. In the real world, files from crossplatforms are distributed via e-mail, network-attached storage (NAS), shared drives, Etc. However, most malware detection models target only single-platform. Therefore, malware detection of cross-platforms has a significant and essential role. We propose HMLET, a cross-platform malware detection model. Our proposed HMLET uses content-based information that binary files all have in common, rather than file structure-based information that is not common to each platform, to detect malware of various file types in the cross-platform. We create file content-based information features for malware detection using wavelet transform. However, fixing the input data length when performing wavelet transform was necessary because the amount of information extracted according to the input data length was not constant. We fix the input data length through the Joint Probability Distribution (JPD) matrix to solve the input data length problem. After learning in the machine learning model, malware detection performance was evaluated through extracted features. Malware detection performance on the Windows platform showed 97% accuracy on HMLET and 99% on the Linux platform. In addition, on the Windows & Linux platform, HMLET showed 97% accuracy. According to experiment results, HMLET shows high-performance malware detection in the cross-platform, making it suitable to be used as a malware detection model in the cross-platform.

show abstract