Malware Detection Based on Deep Learning of Behavior Graphs

Abstract

The Internet of Things (IoT) provides various benefits, which makes smart device even closer. With more and more smart devices in IoT, security is not a one-device affair. Many attacks targeted at traditional computers in IoT environment may also aim at other IoT devices. In this paper, we consider an approach to protect IoT devices from being attacked by local computers. In response to this issue, we propose a novel behavior-based deep learning framework (BDLF) which is built in cloud platform for detecting malware in IoT environment. In the proposed BDLF, we first construct behavior graphs to provide efficient information of malware behaviors using extracted API calls. We then use a neural network-Stacked AutoEncoders (SAEs) for extracting high-level features from behavior graphs. The layers of SAEs are inserted one after another and the last layer is connected to some added classifiers. The architecture of the SAEs is 6,000-2,000-500. The experiment results demonstrate that the proposed BDLF can learn the semantics of higher-level malicious behaviors from behavior graphs and further increase the average detection precision by 1.5%.

A Novel Malware Classification Method Based on Crucial Behavior

“…e value [27] API call sequence Simple, vulnerable to reorder or irrelevant API calls Lee et al [28] API call sequence Hansen et al [29] API call sequence; arguments; frequency Amin [30,31] Opcode End-to-end learning D'Angelo et al [32] API call sequence-based image Park et al [34] Behavioral graph High dimensional features can bring more calculations Elhadi et al [11] API call graph Nikolopoulos and Polenakis [35] System call dependency graph Fredrikson et al [37] Optimally discriminative specification Simplified representation of behavior graphs Alam et al [40] Control flow graph-based feature Ding et al [41] API dependency graph 4 Mathematical Problems in Engineering 0x0000044c of Handle is used to connect the RegQuer-yValue on line 2. e details of API call graph construction are described in our previous work [43]. It is necessary to extract crucial behaviors from the API call graph for malware classification.…”

An API Semantics-Aware Malware Detection Method Based on Deep Learning

“…In [14], the authors construct behavior graphs to provide efficient information of malware behaviors using extracted API calls. e high-level features of the behavior graphs are then extracted using a neural network-Stacked AutoEncoders.…”

“…e CNN model is very effective for learning image features and is very effective for learning data with local features. SVM is a classic traditional machine learning model, but its learning ability is weaker than deep learning models such as Input: sample, length (the length of sample), N (the length of the window), M (threshold for voting), C (a set of all trained model for classification) Output: set (store all API slices to be cut) (1) function SplitWindow (sample, length, N) (2) initial place in the beginning of the sample (3) repeat (4) split the sample with the solid window (5) move the window with a step 1 (6) until move to the end of sample (7) move all API slices into set (8) Remove duplicates (9) return set (10) end function (11) Input: set (generated by Call SplitWindow ()), M (threshold for voting), C (a set of all trained model for classification) Output: category (normal or malicious) (12) function DECISION MAKING (set, m, C) (13) for each s ∈ set do (14) for each f ∈ C do (15) p � f(s) (16) if p > 0.5 then (17) s is belong to normal slice (18) else (19) s is belong to malicious slice (20) end if (21) record the result for s (22) end for (23) end for (24) number � account(s malicious ) (25) total � account(s all ) (26) if number/total > m then (27) return malicious (28) else (29) return normal (30) ALGORITHM 1: Classifying an unknown sample. Security and Communication Networks LSTM and CNN.…”

Proactive VNF Scaling with Heterogeneous Cloud Resources: Fusing Long Short-Term Memory Prediction and Cooperative Allocation

“…However, previous studies ignored the diversity of network function resource requirements and the heterogeneity of actual server resource configuration, which can easily result in resource fragmentation and hence low resource utilization [6,12]. Deep learning is a branch of machine learning that attempts to learn high-level features directly from the original data [18]. Inspired by the successful use of deep learning on traffic flow [19], in this paper, we use long short-term memory recurrent neural network (LSTM RNN) to predict the customer service chain requests and the size of the flow in the NFV network.…”