Research of Obfuscated Malware with a Capsule Neural Network

Abstract

The paper presents the results of a research of using transfer training of the capsule neural network to detect malware. The research was carried out on the basis of the source code of malware using the context-triggered piecewise hashing method. The source codes of malware were obtained from public sources of software. Verification of the capsule neural network learning results was carried out using a trained convolutional neural network, and publicly available sources of test to malware. The research was conducted on six types of malware. Software source code, part of capsule neural network training datasets, pre-trained capsule neural network, and full research are publicly available at https://github.com/T-JN.

Research the Multidimensional Logistic Function in the Intrusion Detection System With Machine Learning

“…Software implementing softmax is integrated into the convolutional neural network (CNN) that searches for malware (detailed in [5]) using the CTPH method). The change in softmax occurs according to the following scheme (Fig.…”

“…To achieve the goal of preserving the previous state of the neural network, it is necessary to develop such a softmax type that, with the value of its output vector, the number of logits is constant. In this paper, research the use of datasets of malicious polymorphic software abc, cheeba, december_3, stasi, otario, dm, v-sign, tequila, flip detected by piecewise context hashing [5].…”

Polymorphic Malware Analysis Model

“…To increase the reliability of the results, the SDN using Hyper-V is displayed in a separate vlan (virtual local network, vlan). Quantitative and qualitative results were compared with the results obtained using the ssdeep software [27] and the methods proposed in [28][29], as well as with the virustotal service. The research scheme in SDN is presented in Fig.…”

Research of Model Increasing Reliability Intrusion Detection Systems

“…It is necessary to detect a malicious dataset in normalized traffic. The mathematical model construction was carried out on the basis of the formulas obtained in the sources [16,17]. There are network traffic 𝑋 inputs that contain malware fragments (1).…”

“…Similarly for the 𝑖 -th neighbor of the entity 𝜐 in the dataset 𝑦 𝑖;𝜐 . Using the formula (3 from the source [17], we determine the malicious kNN components for the traffic arriving in the NI.…”