Intelligent OS X malware threat detection with code inspection

Abstract

With the increasing market share of Mac OS X operating system, there is a corresponding increase in the number of malicious programs (malware) designed to exploit vulnerabilities on Mac OS X platforms. However, existing manual and heuristic OS X malware detection techniques are not capable of coping with such a high rate of malware. While machine learning techniques offer promising results in automated detection of Windows and Android malware, there have been limited efforts in extending them to OS X malware detection. In this paper, we propose a supervised machine learning model. The model applies kernel base Support Vector Machine and a novel weighting measure based on application library calls to detect OS X malware. For training and evaluating the model, a dataset with a combination of 152 malware and 450 benign were created. Using common supervised Machine Learning algorithm on the dataset, we obtain over 91% detection accuracy with 3.9% false alarm rate. We also utilize Synthetic Minority Over-sampling Technique (SMOTE) to create three synthetic datasets with different distributions based on the refined version of collected dataset to investigate impact of different sample sizes on accuracy of malware detection. Using SMOTE datasets we could achieve over 96% detection accuracy and false alarm of less than 4%.All malware classification experiments are tested using cross validation technique. Our results reflect that increasing sample size in synthetic datasets has direct positive effect on detection accuracy while increases false alarm rate in compare to the original dataset.

A Comprehensive Review on Malware Detection Approaches

“…A supervised ML model is proposed in [78]. The model applied a kernel base SVM that used weighting measures, which calculates the frequency of each library call to detect Mac OS X malware.…”

Mac-A-Mal: macOS malware analysis framework resistant to anti evasion techniques

“…They also provide bindings for scripting languages such as Python. Static features can be feed to machine learning algorithms to automatically classify malware samples in [4,10]. They extracted binary header, load commands, and segments features from the dataset of 2300 benign and 760 malicious samples and achieved 96.62% accuracy.…”

An opcode‐based technique for polymorphic Internet of Things malware detection

“…There has been effort to merge machine learning techniques with static and dynamic malware analysis techniques to automate malware analysis tasks . Unlike Windows, Linux, OSX, and Android malware, IoT malware detection appears to be a topic that is under‐studied, perhaps due to the diversity in such devices with varying computational capabilities and resource‐constrained effects (eg, sensors, 3D printers, smart TV, smart fridge, and intelligent roadside units). Azmoodeh et al proposed a method for crypto‐ransomware detection in IoT networks based on power consumption.…”

“…Similar to existing approaches, including our previous approach, we use the typical metrics – True Positive (TP), True Negative (TN), False Positive (FP), and False Negative (FN) – to evaluate the performance of our proposed approach. TP reflects malware samples that are correctly predicted, TN demonstrates goodware samples that are correctly predicted, FP indicates goodware samples that are incorrectly predicted as a malware, and FN shows malware samples that are incorrectly predicted as benign.…”