An Investigation to Detect Banking Malware Network Communication Traffic Using Machine Learning Techniques

Abstract

Banking malware are malicious programs that attempt to steal confidential information, such as banking authentication credentials, from users. Zeus is one of the most widespread banking malware variants ever discovered. Since the Zeus source code was leaked, many other variants of Zeus have emerged, and tools such as anti-malware programs exist that can detect Zeus; however, these have limitations. Anti-malware programs need to be regularly updated to recognise Zeus, and the signatures or patterns can only be made available when the malware has been seen. This limits the capability of these anti-malware products because they are unable to detect unseen malware variants, and furthermore, malicious users are developing malware that seeks to evade signature-based anti-malware programs. In this paper, a methodology is proposed for detecting Zeus malware network traffic flows by using machine learning (ML) binary classification algorithms. This research explores and compares several ML algorithms to determine the algorithm best suited for this problem and then uses these algorithms to conduct further experiments to determine the minimum number of features that could be used for detecting the Zeus malware. This research also explores the suitability of these features when used to detect both older and newer versions of Zeus as well as when used to detect additional variants of the Zeus malware. This will help researchers understand which network flow features could be used for detecting Zeus and whether these features will work across multiple versions and variants of the Zeus malware.

Cyber Threats Classifications and Countermeasures in Banking and Financial Sector

“…Many literatures classified cyber threats in the banking sector into many groups [22] like malware, phishing, distributed denial of service (DDoS), and insider threats. Malware is a type of malicious software designed to infiltrate a system and disrupt its operations [23]. Malware can be used to steal sensitive information, such as user credentials, banking details, and personal information.…”

Enhancing Intrusion Detection Systems With a Novel Hybrid Learning-Based Framework

“…For the most part, commercial NIDS rely on either measurable indicators or calculated thresholds on features, such as packets of data, inter-arrival time, flow size, and other web traffic parameters, to design them in such a way that they function effectively within a specific time window. This allows the commercial NIDS to effectively model the various network traffic parameters [13]. They have a high rate of both false positives as well as false negative alarms, which is a problem for them.…”