Quantum Mayfly Optimization with Encoder-Decoder Driven LSTM Networks for Malware Detection and Classification Model

Alzubi, Omar A.; Alzubi, Jafar A.; Alzubi, Tareq Mahmod; Singh, Ashish

doi:10.1007/s11036-023-02105-x

Cited by 30 publications

(5 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [15], Alzubi et al proposed a malware detection mechanism by combining SVM and Haris Hawk Optimization algorithm. In [16], Alzubi et al proposed the OELSTM-MDC model to detect whether an application is a malware or not. In [17], Maray et al proposed a mechanism to detect Android malware from static API features using the IPR-EODL approach.…”

Section: Literature Reviewmentioning

confidence: 99%

“…In future, the informative syscall subsequence based features would be refined by including the relevant syscall argument related information for training the classifier. Moreover, the most sophisticated feature selection methods such as Quatum Mayfly-based feature selection [16] would be incorporated to select the most prominent features for accurate malware detection.…”

Section: Limitations and Future Scopementioning

confidence: 99%

See 1 more Smart Citation

Android Malware Detection Based on Informative Syscall Subsequences

Surendran,

Uddin,

Thomas

et al. 2024

IEEE Access

View full text Add to dashboard Cite

The Android operating system commands a dominant market share of over 70% in the smartphone industry. However, this widespread usage has resulted in a concerning increase in malware applications. While existing static malware detection mechanisms are vulnerable to code obfuscation attacks, manipulating the runtime system call (syscall) sequence remains a significant challenge for attackers. Consequently, syscall-based malware detection mechanisms are gaining prominence. Current syscall-based malware detection approaches rely on machine learning algorithms, utilizing numerical features such as syscall frequencies and transition probability matrices. However, the wide range of values in these features necessitates large datasets for effective classifier training, and susceptibility to noise and outliers persists. As a result, there is an urgent need for a binary representation of dynamic features to improve malware detection efficiency. To address this challenge, our paper proposes an innovative syscall subsequence-based binary feature representation method for machine learning-driven malware detection. By employing the information gain method, we identify informative syscall subsequences. The proposed mechanism achieves an impressive 99% accuracy in detecting malware applications using just 50% of the training data, across both the Drebin/AMD and CICMalDroid2020 datasets.

show abstract

Section: Literature Reviewmentioning

confidence: 99%

Section: Limitations and Future Scopementioning

confidence: 99%

Android Malware Detection Based on Informative Syscall Subsequences

Surendran,

Uddin,

Thomas

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…They compared the behavior profile of malware applications and conducted the familial classification of malware with accuracy around 98%. Alzubi et al [36] proposed an LSTM network for malware classification which is encoder-decoder driven. For choosing optimal feature sets they used Quantum mayfly optimization-based feature section approach and achieved an accuracy of 98.33%.…”

Section: Related Workmentioning

confidence: 99%

Android Malware Detection using HexCode Features

Anand,

Singh,

Dhoundiyal

2024

Preprint

View full text Add to dashboard Cite

With the widespread adoption of smartphones, Android has emerged as a preferred and highly targeted platform by malware. The proliferation of malware for Android devices has been exponential and to counter this Android malware detection together with familial classification has to be automated. This paper introduces a dual-pronged approach for Android malware detection and familial classification. The proposed approach employs a static analysis approach to extract Java ARchive (JAR) files from Android application packages (APKs). Our methodology involves utilizing extensive hex strings derived from JAR files and applying n-gram sliding window technique to extract features. To validate the robustness of our model and assess its versatility, we employed both standard and obfuscated malware datasets. A range of machine learning models, including Naive Bayes(NB), Random Forest(RF), Support Vector Machine (SVM), K-Nearest Neighbors (KNN), Decision Tree (DT) and a Convolutional Neural Network (CNN) for familial classification, were employed. The experiments encompassed non-obfuscated malware samples (5560), obfuscated malware samples (15479), and benign samples (6200). Additionally, we conducted a comparative analysis of our model's performance against existing methods, including those based on deep learning.

show abstract

“…They used a lightweight classifier to find the similarity between API call graphs and get an accuracy of 91.27%. Alzubi et al [46] studied optimal encoder-decoder driven LSTM model for malware classification and detection. They used Quantum Mayfly optimization for feature selection and Butterfly optimization for parameter tuning and get an accuracy of 98.33%.…”

Section: Related Workmentioning

confidence: 99%

Android Malware Detection using LSTM with Smali Codes

Anand

Singh

Khan

et al. 2023

Preprint

View full text Add to dashboard Cite

With the widespread adoption of smartphones and the rapid growth of the mobile Internet, the Android platform has become highly popular. However, its open-source nature has also made it susceptible to rampant malware attacks. In light of this, this research paper proposes a malware detection system based on Smali-LSTM to enhance the efficiency of malware detection on the Android platform. The detection system employs a static analysis approach to extract Smali files from applications. These extracted Smali files undergo a series of preprocessing steps to extract relevant features. To ensure compatibility with the LSTM model, the preprocessed Smali files are fragmented into smaller pieces. The paper explores and tests fragments of various sizes to identify the optimal configuration that yields the best results. The findings of the study demonstrate that the proposed Smali-LSTM model outperforms existing works that utilize the same dataset and LSTM model. The achieved results showcase an accuracy of 96.58\% and an impressive precision of 100\%. These outcomes validate the effectiveness and superiority of the proposed model in accurately detecting malware in Android applications.

show abstract

Quantum Mayfly Optimization with Encoder-Decoder Driven LSTM Networks for Malware Detection and Classification Model

Cited by 30 publications

References 44 publications

Android Malware Detection Based on Informative Syscall Subsequences

Android Malware Detection Based on Informative Syscall Subsequences

Android Malware Detection using HexCode Features

Android Malware Detection using LSTM with Smali Codes

Contact Info

Product

Resources

About