Obfuscated Malware Detection: Impacts on Detection Methods

Gorment, Nor Zakiah; Selamat, Ali; Krejcar, Ondrej

doi:10.1007/978-3-031-42430-4_5

Cited by 2 publications

(3 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These sophisticated adversaries deploy evasion techniques with unparalleled finesse, seeking to cloak their true identities and activities within the vast expanse of digital operations. Obfuscated malware achieves this by employing a myriad of tactics, including code encryption, polymorphic behavior, and other obfuscation techniques that challenge traditional signature-based detection systems (Dang 2024;Gorment et al 2023).…”

Section: Background Of Obfuscated Malware In Memory Dumpsmentioning

confidence: 99%

“…Addressing the challenge of obfuscated malware detection is imperative in the current digital ecosystem, where reliance on technology is at an all-time high (Gorment et al 2023). In an era where data is the new currency and digital interactions underpin the majority of our daily activities, the potential impact of malware intrusions is vast and multifaceted.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Enhanced detection of obfuscated malware in memory dumps: a machine learning approach for advanced cybersecurity

Hossain,

Islam

2024

Cybersecurity

View full text Add to dashboard Cite

In the realm of cybersecurity, the detection and analysis of obfuscated malware remain a critical challenge, especially in the context of memory dumps. This research paper presents a novel machine learning-based framework designed to enhance the detection and analytical capabilities against such elusive threats for binary and multi type’s malware. Our approach leverages a comprehensive dataset comprising benign and malicious memory dumps, encompassing a wide array of obfuscated malware types including Spyware, Ransomware, and Trojan Horses with their sub-categories. We begin by employing rigorous data preprocessing methods, including the normalization of memory dumps and encoding of categorical data. To tackle the issue of class imbalance, a Synthetic Minority Over-sampling Technique is utilized, ensuring a balanced representation of various malware types. Feature selection is meticulously conducted through Chi-Square tests, mutual information, and correlation analyses, refining the model’s focus on the most indicative attributes of obfuscated malware. The heart of our framework lies in the deployment of an Ensemble-based Classifier, chosen for its robustness and effectiveness in handling complex data structures. The model’s performance is rigorously evaluated using a suite of metrics, including accuracy, precision, recall, F1-score, and the area under the ROC curve (AUC) with other evaluation metrics to assess the model’s efficiency. The proposed model demonstrates a detection accuracy exceeding 99% across all cases, surpassing the performance of all existing models in the realm of malware detection.

show abstract

Section: Background Of Obfuscated Malware In Memory Dumpsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Enhanced detection of obfuscated malware in memory dumps: a machine learning approach for advanced cybersecurity

Hossain,

Islam

2024

Cybersecurity

View full text Add to dashboard Cite

show abstract

“…In stark contrast, malicious samples frequently exhibit a conspicuous paucity of comments. The rationale underpinning this lies in attackers intentionally eschewing explanations, a tactical maneuver designed to obfuscate analysis and augment the complexity for researchers endeavoring to discern their objectives [46].…”

Section:  F83 (Comment Ratio)mentioning

confidence: 99%

Enhancing Cybersecurity With P-Code Analysis and XGBoost: A Novel Approach for Malicious VBA Macro Detection in Office Documents

Ahmadi,

Chen,

Lai

2024

IEEE Access

View full text Add to dashboard Cite

In the evolving landscape of cybersecurity, the prevalence of malicious Visual Basic for Applications (VBA) macros embedded in Office documents presents a formidable challenge. These macros, while integral to automation, have become potent vehicles for cyber-attacks, necessitating advanced detection techniques. This study introduces a comprehensive framework employing P-Code Analysis and XGBoost, a leading-edge machine learning algorithm, to address this issue. The proposed solution synergizes static analysis of VBA source code with dynamic P-Code structural analysis, enhanced by Natural Language Processing (NLP) techniques for effective feature extraction. By integrating these methodologies, our model adeptly distinguishes between benign and malicious macros, achieving an unprecedented detection accuracy of 98.70% and an F1-score of 98.81% in rigorous testing environments. The core contribution of this research lies in its innovative approach to malicious macro detection, offering a robust framework that significantly improves upon existing methods. Additionally, the utilization of XGBoost for machine learning analysis introduces a novel application in cybersecurity defenses against macro-based threats. The results underscore the efficacy of combining P-Code analysis with machine learning for cybersecurity, marking a significant stride in the detection of sophisticated cyber threats. This study not only advances the domain of cybersecurity but also lays the groundwork for future research, advocating for the exploration of further optimizations and the adaptation of our model to combat evolving attack vectors.

show abstract

Obfuscated Malware Detection: Impacts on Detection Methods

Cited by 2 publications

References 19 publications

Enhanced detection of obfuscated malware in memory dumps: a machine learning approach for advanced cybersecurity

Enhanced detection of obfuscated malware in memory dumps: a machine learning approach for advanced cybersecurity

Enhancing Cybersecurity With P-Code Analysis and XGBoost: A Novel Approach for Malicious VBA Macro Detection in Office Documents

Contact Info

Product

Resources

About