Android Malware Detection Scheme Based on Level of SSL Server Certificate

Kato, Hirokazu; Haruta, Shuichiro; Sasase, Iwao

doi:10.1109/globecom38437.2019.9013483

Cited by 3 publications

(3 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…They also employed Naïve Bayes (NB) in the performance result comparison. Nevertheless, other studies focused on TLS handshake server messages, especially certificate features (Kato et al, 2019;Torroledo et al, 2018). Kato et al (2019) conducted a study on android TLS malware detection, achieving Random Forest (RF) accuracy of 93.90 percent by merging the TLS certificate features of the new scheme with the old scheme and simple DP-based scheme (SDPBS).…”

Section: Related Workmentioning

confidence: 99%

“…Nevertheless, other studies focused on TLS handshake server messages, especially certificate features (Kato et al, 2019;Torroledo et al, 2018). Kato et al (2019) conducted a study on android TLS malware detection, achieving Random Forest (RF) accuracy of 93.90 percent by merging the TLS certificate features of the new scheme with the old scheme and simple DP-based scheme (SDPBS). As demonstrated, TLS features are essential in the detection; therefore, they are utilized with other features in this paper's approach, TLSMalDetect.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

A Machine Learning Classification Approach to Detect TLS-Based Malware Using Entropy-Based Flow Set Features

Keshkeh

Jantan

Alieyan

2022

Journal of Information and Communication Technology

View full text Add to dashboard Cite

Transport Layer Security (TLS) based malware is one of the most hazardous malware types, as it relies on encryption to conceal connections. Due to the complexity of TLS traffic decryption, several anomaly-based detection studies have been conducted to detect TLS-based malware using different features and machine learning (ML) algorithms. However, most of these studies utilized flow features with no feature transformation or relied on inefficient flow feature transformations like frequency-based periodicity analysis and outliers percentage. This paper introduces TLSMalDetect, a TLS-based malware detection approach that integrates periodicity-independent entropy-based flow set (EFS) features generated by a flow feature transformation technique to solve flow feature utilization issues in related research. EFS features effectiveness was evaluated in two ways: (1) by comparing them to the corresponding outliers percentage and flow features using four feature importance methods, and (2) by analyzing classification performance with and without EFS features. Moreover, new Transmission Control Protocol features not explored in literature were incorporated into TLSMalDetect, and their contribution was assessed. This study’s results proved EFS features of the number of packets sent and received were superior to related outliers percentage and flow features and could remarkably increase the performance up to ~42% in the case of Support Vector Machine accuracy. Furthermore, using the basic features, TLSMalDetect achieved the highest accuracy of 93.69% by Naïve Bayes (NB) among the ML algorithms applied. Also, from a comparison view, TLSMalDetect’s Random Forest precision of 98.99% and NB recall of 92.91% exceeded the best relevant findings of previous studies. These comparative results demonstrated the TLSMalDetect’s ability to detect more malware flows out of total malicious flows than existing works. It could also generate more actual alerts from overall alerts than earlier research.Transport Layer Security (TLS) based malware is one of the most hazardous malware types, as it relies on encryption to conceal connections. Due to the complexity of TLS traffic decryption, several anomaly-based detection studies have been conducted to detect TLS-based malware using different features and machine learning (ML) algorithms. However, most of these studies utilized flow features with no feature transformation or relied on inefficient flow feature transformations like frequency-based periodicity analysis and outliers percentage. This paper introduces TLSMalDetect, a TLS-based malware detection approach that integrates periodicity-independent entropy-based flow set (EFS) features generated by a flow feature transformation technique to solve flow feature utilization issues in related research. EFS features effectiveness was evaluated in two ways: (1) by comparing them to the corresponding outliers percentage and flow features using four feature importance methods, and (2) by analyzing classification performance with and without EFS features. Moreover, new Transmission Control Protocol features not explored in literature were incorporated into TLSMalDetect, and their contribution was assessed. This study’s results proved EFS features of the number of packets sent and received were superior to related outliers percentage and flow features and could remarkably increase the performance up to ~42% in the case of Support Vector Machine accuracy. Furthermore, using the basic features, TLSMalDetect achieved the highest accuracy of 93.69% by Naïve Bayes (NB) among the ML algorithms applied. Also, from a comparison view, TLSMalDetect’s Random Forest precision of 98.99% and NB recall of 92.91% exceeded the best relevant findings of previous studies. These comparative results demonstrated the TLSMalDetect’s ability to detect more malware flows out of total malicious flows than existing works. It could also generate more actual alerts from overall alerts than earlier research.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

A Machine Learning Classification Approach to Detect TLS-Based Malware Using Entropy-Based Flow Set Features

Keshkeh

Jantan

Alieyan

2022

Journal of Information and Communication Technology

View full text Add to dashboard Cite

show abstract

“…Os modelos híbridos para detecção de malware propostos até o momento utilizam, em sua maioria, como dados dinâmicos chamadas de sistema e informações do uso de hardware dispositivo [Zachariah et al 2017]. Além disso, também existem propostas de trabalhos que utilizam o tráfego de rede [Kato et al 2020] ou chamada de Intents [Alzaylaee et al 2020], que exige instrumentação para coleta dos dados, para detectar tipos específicos de ataques. Dessa forma, este trabalho propõe uma nova abordagem para detecção de malwares no Android baseada em um modelo híbrido que combina dados referentes à comunicação entre processos realizadas pelos aplicativos analisados e informações estáticas dos mesmos.…”

Section: Introductionunclassified

Utilizando Metadados de Aplicações e Comunicação entre Processos para Identificar Ameaças no Android

Lemos¹,

Heinrich²,

Maziero³

2021

Anais Do XXI Simpósio Brasileiro De Segurança Da Informação E De Sistemas Computacionais (SBSeg 2021)

View full text Add to dashboard Cite

A predominância do Android no mercado de dispositivos móveis e o aumento significativo na quantidade e na sofisticação dos ataques cibernéticos, destaca a necessidade do estudo de técnicas de identificação de ameaças no meio de dispositivos móveis. Uma estratégia popular para a identificação de ameças é a utilização de um sistema de detecção de intrusão, que pode explorar diferentes estratégias para realizar a identificação das ameaças. Este estudo apresenta uma estratégia para a identificação de ameaças utilizando uma base de dados híbrida, explorando dados extraídos de aplicações e da comunicação entre processos para treinar modelos de aprendizado de máquina para efetuar a identificação de ameças. Os resultados demonstram que um modelo híbrido traz benefícios para a identificação de ameaças em dispositivos móveis, com uma taxa de identificação em torno de 87%.

show abstract

A Review on TLS Encryption Malware Detection: TLS Features, Machine Learning Usage, and Future Directions

Keshkeh

Jantan

Alieyan

et al. 2021

Communications in Computer and Information Science

View full text Add to dashboard Cite

Android Malware Detection Scheme Based on Level of SSL Server Certificate

Cited by 3 publications

References 11 publications

A Machine Learning Classification Approach to Detect TLS-Based Malware Using Entropy-Based Flow Set Features

A Machine Learning Classification Approach to Detect TLS-Based Malware Using Entropy-Based Flow Set Features

Utilizando Metadados de Aplicações e Comunicação entre Processos para Identificar Ameaças no Android

A Review on TLS Encryption Malware Detection: TLS Features, Machine Learning Usage, and Future Directions

Contact Info

Product

Resources

About