Comparing the performance of supervised machine learning algorithms when used with a manual feature selection process to detect Zeus malware

Kazi, Mohamed Ali; Woodhead, Steve; Gan, Diane

doi:10.1504/ijguc.2022.126167

Cited by 3 publications

(5 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The framework analyses the characteristics of network traffic produced by the Trojans and identifies its patterns using machine learning algorithms. Similarly, the authors in [14] looked into the use of machine learning methods to identify network communication traffic from banking malware. The decision tree and random forest algorithms were successful in identifying the malware traffic after they compared various classification algorithms.…”

Section: Related Workmentioning

confidence: 99%

MoBShield: A Novel XML Approach for Securing Mobile Banking

Seraj,

Sadiq,

Kaiwartya

et al. 2024

CMC

View full text Add to dashboard Cite

Mobile banking security has witnessed significant R&D attention from both financial institutions and academia. This is due to the growing number of mobile baking applications and their reachability and usefulness to society. However, these applications are also attractive prey for cybercriminals, who use a variety of malware to steal personal banking information. Related literature in mobile banking security requires many permissions that are not necessary for the application's intended security functionality. In this context, this paper presents a novel efficient permission identification approach for securing mobile banking (MoBShield) to detect and prevent malware. A permission-based dataset is generated for mobile banking malware detection that consists large number of malicious adware apps and benign apps to use as training datasets. The dataset is generated from 1650 malicious banking apps of the Canadian Institute of Cybersecurity, University of New Brunswick and benign apps from Google Play. A machine learning algorithm is used to determine whether a mobile banking application is malicious based on its permission requests. Further, an eXplainable machine learning (XML) approach is developed to improve trust by explaining the reasoning behind the algorithm's behaviour. Performance evaluation tests that the approach can effectively and practically identify mobile banking malware with high precision and reduced false positives. Specifically, the adapted artificial neural networks (ANN), convolutional neural networks (CNN) and XML approaches achieve a higher accuracy of 99.7% and the adapted deep neural networks (DNN) approach achieves 99.6% accuracy in comparison with the state-of-the-art approaches. These promising results position the proposed approach as a potential tool for real-world scenarios, offering a robust means of identifying and thwarting malware in mobile-based banking applications. Consequently, MoBShield has the potential to significantly enhance the security and trustworthiness of mobile banking platforms, mitigating the risks posed by cyber threats and ensuring a safer user experience.

show abstract

Section: Related Workmentioning

confidence: 99%

MoBShield: A Novel XML Approach for Securing Mobile Banking

Seraj,

Sadiq,

Kaiwartya

et al. 2024

CMC

View full text Add to dashboard Cite

show abstract

“…The first figure shows the various stages of the Command-and-control communication discussed by Preethi and Asokan [8]. This communication can occur using either a centrally controlled architecture or a mentoring architecture, with the latter being extra Strong and resilient [2]. This is because the ZBot bots won't be able to receive commands, update software, or download new configuration files from the Command-and-control server if that server goes down or isn't available [10].…”

Section: Architecture Of the Zbot Malwarementioning

confidence: 99%

“…According to [2], ZBot behaves like a virus and spreads mostly through spam schemes, making it one of the most common ways malware is disseminated and infects Windows computers. Ref.…”

Section: Architecture Of the Zbot Malwarementioning

confidence: 99%

“…One of these financial services variants, ZBot (hereafter referred to as God), Currently ranks among the most prevalent forms of banking malware [1]. However, since 2011, the source code has been released to the public, enabling the generation of a wide variety of novel variants [2,3]. But since the ZBot password was leaked, numerous ZBot varieties have emerged, including Ramnit, ZbotPanda and Citadel.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Meta-Classification Model for Optimized ZBot Malware Prediction Using Learning Algorithms

et al. 2023

View full text Add to dashboard Cite

Botnets pose a real threat to cybersecurity by facilitating criminal activities like malware distribution, attacks involving distributed denial of service, fraud, click fraud, phishing, and theft identification. The methods currently used for botnet detection are only appropriate for specific botnet commands and control protocols; they do not endorse botnet identification in early phases. Security guards have used honeypots successfully in several computer security defence systems. Honeypots are frequently utilised in botnet defence because they can draw botnet compromises, reveal spies in botnet membership, and deter attacker behaviour. Attackers who build and maintain botnets must devise ways to avoid honeypot traps. Machine learning methods support identification and inhibit bot threats to address the problems associated with botnet attacks. To choose the best features to feed as input to the machine learning classifiers to estimate the performance of botnet detection, a Kernel-based Ensemble Meta Classifier (KEMC) Strategy is suggested in this work. And particle swarm optimization (PSO) and genetic algorithm (GA) intelligent optimization algorithms are used to establish the ideal order. The model covered in this paper is employed to forecast Internet cyber security circumstances. The Binary Cross-Entropy (loss), the GA-PSO optimizer, the Softsign activation functions and ensembles were used in the experiment to produce the best results. The model succeeded because Forfileless malware, gathered from well-known datasets, achieved a total accuracy of 93.3% with a True Positive (TP) Range of 87.45% at zero False Positive (FP).

show abstract

“…Stolen data is routed through the C&C network to the mal ware authors' C&C server, where the stolen data is decrypted and saved to a database [19]. As discussed by [20], Zeus propagates like a virus, mainly infecting Windows systems and predominantly, the infection vector occurs via phishing emails, which is a significant distribution mechanism for malware. Research by [21] has discussed this in detail, and states that around 90 percent of data breaches are caused by phishing.…”

Section: Zeus Malware Architecturementioning

confidence: 99%

An Investigation to Detect Banking Malware Network Communication Traffic Using Machine Learning Techniques

Kazi

Woodhead

Gan

2022

JCP

Self Cite

View full text Add to dashboard Cite

Banking malware are malicious programs that attempt to steal confidential information, such as banking authentication credentials, from users. Zeus is one of the most widespread banking malware variants ever discovered. Since the Zeus source code was leaked, many other variants of Zeus have emerged, and tools such as anti-malware programs exist that can detect Zeus; however, these have limitations. Anti-malware programs need to be regularly updated to recognise Zeus, and the signatures or patterns can only be made available when the malware has been seen. This limits the capability of these anti-malware products because they are unable to detect unseen malware variants, and furthermore, malicious users are developing malware that seeks to evade signature-based anti-malware programs. In this paper, a methodology is proposed for detecting Zeus malware network traffic flows by using machine learning (ML) binary classification algorithms. This research explores and compares several ML algorithms to determine the algorithm best suited for this problem and then uses these algorithms to conduct further experiments to determine the minimum number of features that could be used for detecting the Zeus malware. This research also explores the suitability of these features when used to detect both older and newer versions of Zeus as well as when used to detect additional variants of the Zeus malware. This will help researchers understand which network flow features could be used for detecting Zeus and whether these features will work across multiple versions and variants of the Zeus malware.

show abstract

Comparing the performance of supervised machine learning algorithms when used with a manual feature selection process to detect Zeus malware

Cited by 3 publications

References 0 publications

MoBShield: A Novel XML Approach for Securing Mobile Banking

MoBShield: A Novel XML Approach for Securing Mobile Banking

A Meta-Classification Model for Optimized ZBot Malware Prediction Using Learning Algorithms

An Investigation to Detect Banking Malware Network Communication Traffic Using Machine Learning Techniques

Contact Info

Product

Resources

About