Exploring Function Call Graph Vectorization and File Statistical Features in Malicious PE File Classification

Zhang, Yipin; Chang, Xiaolin; Lin, Yuzhou; Mišić, Jelena

doi:10.1109/access.2020.2978335

Cited by 12 publications

(4 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The methodology (see Fig. 5) describes a technique for detecting ransomware using Cuckoo Sandbox [31], feature extraction from Portable Executable (PE) files [32], and YARA rules [33]. By analysing the characteristics and patterns of PE files, it is possible to identify potential ransomware threats and lessen their impact.…”

Section: Methodsmentioning

confidence: 99%

Unraveling Ransomware: Detecting Threats with Advanced Machine Learning Algorithms

Hammadeh,

Kavitha

2023

IJACSA

View full text Add to dashboard Cite

In our contemporary world, the pervasive influence of information technology, computer engineering, and the Internet has undeniably catalyzed innovation, fostering unparalleled economic growth and revolutionizing education. This technological juggernaut, however, has unwittingly ushered in a parallel era of new criminal frontiers, a magnet for hackers and cybercriminals. These malevolent actors exploit the vast expanse of electronic devices and interconnected networks to perpetrate an array of cybercrimes, and among these insidious digital threats, ransomware reigns supreme. Ransomware, characterized by its ominous ability to encrypt victims' data and extort payment for its release, stands as a dire menace to individuals and organizations alike. Operating with stealth and propagating with alarming alacrity through digital networks, ransomware has emerged as a formidable adversary in the digital age. This research paper focuses on the evolving stages of ransomware, driven by cutting-edge technologies, and proposes essential methods and ideas to detect and combat this menace. The proposed methodology, anchored in Cuckoo Sandbox, PE file feature extraction, and YARA rules, orchestrates three crucial phases: data collection, feature selection, and data preprocessing, all harmonizing to strengthen our defense against this concealed cyber menace. This paper contributes to the development of effective solutions for detecting and mitigating this hidden and insidious cyber threat. This work involves the application of multiple machine learning algorithms, including LSTM, which achieves an impressive accuracy of 99% in identifying ransomware attacks.

show abstract

Section: Methodsmentioning

confidence: 99%

Unraveling Ransomware: Detecting Threats with Advanced Machine Learning Algorithms

Hammadeh,

Kavitha

2023

IJACSA

View full text Add to dashboard Cite

show abstract

“…The next type of graph-based feature is the Function Call Graph (FCG). The FCG is also a directed graph constructed from programs where the vertices specify the functions and the edges define the caller-callee relationship between functions [39]. In the paper [11], there is another type of graph-based feature: the opcode sequence graph.…”

Section: ) Static Analysismentioning

confidence: 99%

IoT Malware Analysis Using Federated Learning: A Comprehensive Survey

2023

View full text Add to dashboard Cite

The Internet of Things (IoT) has paved the way to a highly connected society where all things are interconnected and exchanging information has become more accessible through the internet. With the use of IoT devices, the threat of malware has increased rapidly. The increased number of existing and new malware variants has made protecting IoT devices and networks challenging. The malware can hide in the systems and disables its activity when there are attempts to discover and detect them. With technological advances, there are various emerging techniques to address this problem. However, they still encounter issues concerning the privacy and security of the user's data and suffer from a single point of failure. To address this issue, there are recent research developments conducted to use Federated Learning (FL). FL is a decentralized technique that trains the user's data on-device and exchanges the parameters without sharing the user's data. FL is implemented to secure the user's data, provide safe and accurate models, and prevent the single point of failure in the centralized models. This paper provides an overview of different approaches that integrate FL with IoT. Finally, we discuss the applications of FL, the research challenges, and future research directions.

show abstract

“… Zhang et al (2020) explored function call graph vectorization representation (FCGV) as the input feature to machine learning algorithms for classification and noted that this representation loses some critical features of PE files due to the hash technique being used. They improved the classification accuracy of the FCGV-based machine learning model by applying both graph and non-graph features and achieved a maximum accuracy of 99.5% with non-graph, i.e., statistical features.…”

Section: Literature Reviewmentioning

confidence: 99%

Windows malware detection based on static analysis with multiple features

Yousuf

Anwer

Riasat

et al. 2023

PeerJ Computer Science

View full text Add to dashboard Cite

Malware or malicious software is an intrusive software that infects or performs harmful activities on a computer under attack. Malware has been a threat to individuals and organizations since the dawn of computers and the research community has been struggling to develop efficient methods to detect malware. In this work, we present a static malware detection system to detect Portable Executable (PE) malware in Windows environment and classify them as benign or malware with high accuracy. First, we collect a total of 27,920 Windows PE malware samples divided into six categories and create a new dataset by extracting four types of information including the list of imported DLLs and API functions called by these samples, values of 52 attributes from PE Header and 100 attributes of PE Section. We also amalgamate this information to create two integrated feature sets. Second, we apply seven machine learning models; gradient boosting, decision tree, random forest, support vector machine, K-nearest neighbor, naive Bayes, and nearest centroid, and three ensemble learning techniques including Majority Voting, Stack Generalization, and AdaBoost to classify the malware. Third, to further improve the performance of our malware detection system, we also deploy two dimensionality reduction techniques: Information Gain and Principal Component Analysis. We perform a number of experiments to test the performance and robustness of our system on both raw and selected features and show its supremacy over previous studies. By combining machine learning, ensemble learning and dimensionality reduction techniques, we construct a static malware detection system which achieves a detection rate of 99.5% and error rate of only 0.47%.

show abstract

Exploring Function Call Graph Vectorization and File Statistical Features in Malicious PE File Classification

Cited by 12 publications

References 27 publications

Unraveling Ransomware: Detecting Threats with Advanced Machine Learning Algorithms

Unraveling Ransomware: Detecting Threats with Advanced Machine Learning Algorithms

IoT Malware Analysis Using Federated Learning: A Comprehensive Survey

Windows malware detection based on static analysis with multiple features

Contact Info

Product

Resources

About