Malware Detection Using LightGBM With a Custom Logistic Loss Function

Gao, Yun; Hasegawa, Hirokazu; Yamaguchi, Yukiko; Shimada, Hiroyuki

doi:10.1109/access.2022.3171912

Cited by 11 publications

(6 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…(d) Decision trees [7] are another ML technique that has been frequently employed in combination with other supportive algorithms for malware detection. (e) Logistic regression [8] is a statistical method used to figure out how likely a binary outcome is to happen. It has been used successfully in programs that look for malware.…”

Section: The Role Of Machine Learning In Ransomware Defensementioning

confidence: 99%

Securing IoT Devices Running PureOS from Ransomware Attacks: Leveraging Hybrid Machine Learning Techniques

et al. 2023

View full text Add to dashboard Cite

Internet-enabled (IoT) devices are typically small, low-powered devices used for sensing and computing that enable remote monitoring and control of various environments through the Internet. Despite their usefulness in achieving a more connected cyber-physical world, these devices are vulnerable to ransomware attacks due to their limited resources and connectivity. To combat these threats, machine learning (ML) can be leveraged to identify and prevent ransomware attacks on IoT devices before they can cause significant damage. In this research paper, we explore the use of ML techniques to enhance ransomware defense in IoT devices running on the PureOS operating system. We have developed a ransomware detection framework using machine learning, which combines the XGBoost and ElasticNet algorithms in a hybrid approach. The design and implementation of our framework are based on the evaluation of various existing machine learning techniques. Our approach was tested using a dataset of real-world ransomware attacks on IoT devices and achieved high accuracy (90%) and low false-positive rates, demonstrating its effectiveness in detecting and preventing ransomware attacks on IoT devices running PureOS.

show abstract

Section: The Role Of Machine Learning In Ransomware Defensementioning

confidence: 99%

Securing IoT Devices Running PureOS from Ransomware Attacks: Leveraging Hybrid Machine Learning Techniques

et al. 2023

View full text Add to dashboard Cite

show abstract

“…An investigation to classification accuracy of malware was done by [35]. The process is done using custom log loss function and Based on LightGBM.…”

Section: Related Workmentioning

confidence: 99%

Impact of Portable Executable Header Features on Malware Detection燗ccuracy

Al-Khshali¹,

Ilyas²

2023

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

One aspect of cybersecurity, incorporates the study of Portable Executables (PE) files maleficence. Artificial Intelligence (AI) can be employed in such studies, since AI has the ability to discriminate benign from malicious files. In this study, an exclusive set of 29 features was collected from trusted implementations, this set was used as a baseline to analyze the presented work in this research. A Decision Tree (DT) and Neural Network Multi-Layer Perceptron (NN-MLPC) algorithms were utilized during this work. Both algorithms were chosen after testing a few diverse procedures. This work implements a method of subgrouping features to answer questions such as, which feature has a positive impact on accuracy when added? Is it possible to determine a reliable feature set to distinguish a malicious PE file from a benign one? when combining features, would it have any effect on malware detection accuracy in a PE file? Results obtained using the proposed method were improved and carried few observations. Generally, the obtained results had practical and numerical parts, for the practical part, the number of features and which features included are the main factors impacting the calculated accuracy, also, the combination of features is as crucial in these calculations. Numerical results included, finding accuracies with enhanced values, for example, NN_MLPC attained 0.979 and 0.98; for DT an accuracy of 0.9825 and 0.986 was attained.

show abstract

“…The best results in the model are obtained with the weighted rank voting method according to class accuracies. In the study [15], a malware detection model using LightGBM with a special log loss function is presented. The accuracy performances of static methods were examined within the scope of malware detection.…”

Section: Related Workmentioning

confidence: 99%

“…Euh et al [11] Original dataset Extra Gradient Boosting (XGB) Accuracy (WEM)-100% Accuracy (API)-94.7% Cohen et al [12] Original dataset LightGBM Accuracy-95.1% Singh et al [13] Original dataset AdaBoost (ADAB) Accuracy-99.54% Gupta et al [14] Original dataset Bagging Accuracy-99.5% TPR-99.6% Gao et al [15] EMBER 2017 LightGBM Accuracy-99.81% (EMBER) FFRI Accuracy-99.84 %(FFRI) Kumar et al [16] Original dataset Random Forest (RF), LightGBM, XGB, Extra Trees (EXT) Accuracy-98.49% [18] Original dataset K-mode, Bagging Accuracy-99.41% F1 Score-99.13% Yang et al [19] Datacon 2019 t-SNE, Stacking Accuracy-99.67% F1 Score-99.67% Appice et al [20] Original dataset K-means++, Stacking Sensitivity-96% AUC-96.6% Ramadhan et al [21] BODMAS Bagging (LightGBM, XGB, Logistic Accuracy-99.63% regression)…”

Section: Table 1: Related Workmentioning

confidence: 99%

Clustering-Aided Supervised Malware Detection with Specialized Classifiers and Early Consensus

Dener¹,

Gulburun²

2023

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

One of the most common types of threats to the digital world is malicious software. It is of great importance to detect and prevent existing and new malware before it damages information assets. Machine learning approaches are used effectively for this purpose. In this study, we present a model in which supervised and unsupervised learning algorithms are used together. Clustering is used to enhance the prediction performance of the supervised classifiers. The aim of the proposed model is to make predictions in the shortest possible time with high accuracy and f1 score. In the first stage of the model, the data are clustered with the k-means algorithm. In the second stage, the prediction is made with the combination of the classifier with the best prediction performance for the related cluster. While choosing the best classifiers for the given clusters, triple combinations of ten machine learning algorithms (kernel support vector machine, k-nearest neighbor, naïve Bayes, decision tree, random forest, extra gradient boosting, categorical boosting, adaptive boosting, extra trees, and gradient boosting) are used. The selected triple classifier combination is positioned in two stages. The prediction time of the model is improved by positioning the classifier with the slowest prediction time in the second stage. The selected triple classifier combination is positioned in two tiers. The prediction time of the model is improved by positioning the classifier with the highest prediction time in the second tier. It is seen that clustering before classification improves prediction performance, which is presented using Blue Hexagon Open Dataset for Malware Analysis (BODMAS), Elastic Malware Benchmark for Empowering Researchers (EMBER) 2018 and Kaggle malware detection datasets. The model has 99.74% accuracy and 99.77% f1 score for the BODMAS dataset, 99.04% accuracy and 98.63% f1 score for the Kaggle malware detection dataset, and 96.77% accuracy and 96.77% f1 score for the EMBER 2018 dataset. In addition, the tiered positioning of classifiers shortened the average prediction time by 76.13% for the BODMAS dataset and 95.95% for the EMBER 2018 dataset. The proposed method's prediction performance is better than the rest of the studies in the literature in which BODMAS and EMBER 2018 datasets are used.

show abstract

Malware Detection Using LightGBM With a Custom Logistic Loss Function

Cited by 11 publications

References 29 publications

Securing IoT Devices Running PureOS from Ransomware Attacks: Leveraging Hybrid Machine Learning Techniques

Securing IoT Devices Running PureOS from Ransomware Attacks: Leveraging Hybrid Machine Learning Techniques

Impact of Portable Executable Header Features on Malware Detection燗ccuracy

Clustering-Aided Supervised Malware Detection with Specialized Classifiers and Early Consensus

Contact Info

Product

Resources

About