SVM Training Phase Reduction Using Dataset Feature Filtering for Malware Detection

O’Kane, Philip; Sezer, Sakir; McLaughlin, Kieran; Im, Eul Gyu

doi:10.1109/tifs.2013.2242890

Cited by 63 publications

(30 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…O'Kane et al [7] found that 99.5% of variance in their data was attributed to the top 8 opcodes, providing feature reduction from the original 150 opcodes.…”

Section: A Dynamic Opcode Analysis Of Malwarementioning

confidence: 99%

Dynamic Opcode Analysis of Ransomware

Carlin

O’Kane

Sezer

2018

2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)

Self Cite

View full text Add to dashboard Cite

The explosion of ransomware in recent years has served as a costly reminder that the malware threatscape has moved from that of socially-inept hobbyists to career criminals. This paper investigates the efficacy of dynamic opcode analysis in distinguishing cryptographic ransomware from benignware, and presents several novel contributions. Firstly, a new dataset of cryptoransomware dynamic run-traces, the largest of its kind in the literature. We release this to the wider research community to foster further research in the field. Our second novel contribution demonstrates that a short runlength of 32k opcodes can provide highly accurate detection of ransomware (99.56%) compared to benign software. Third, our model offers a distinct advantage over other models in the literature, in that it can detect a form of benign encryption (i.e. file zipping) with 100% accuracy against not only ransomware, but also the non-encrypting benignware in our dataset. The research presented here demonstrates that dynamic opcode tracing is capable of detecting ransomware in comparable times to static analysis, without being thwarted by obfuscation tactics.

show abstract

“…O'Kane et al [7] found that 99.5% of variance in their data was attributed to the top 8 opcodes, providing feature reduction from the original 150 opcodes.…”

Section: A Dynamic Opcode Analysis Of Malwarementioning

confidence: 99%

Dynamic Opcode Analysis of Ransomware

Carlin

O’Kane

Sezer

2018

2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)

Self Cite

View full text Add to dashboard Cite

show abstract

“…The authors show that their results are more satisfying than the ones got by commercial antivirus software. Concerning the search and analysis of opcodes (from operation code, a portion of a machine language instruction that specifies the operation to be performed), we can mention the literature . In the work of O'Kane, it is aimed at individuating a subset of opcodes suitable for malware detection through SVM.…”

Section: State Of the Artmentioning

confidence: 99%

Statistical fingerprint‐based intrusion detection system (SF‐IDS)

Boero

Cello

Marchese

et al. 2016

Int J Communication

View full text Add to dashboard Cite

Summary Intrusion detection systems (IDS) are systems aimed at analyzing and detecting security problems. The IDS may be structured into misuse and anomaly detection. The former are often signature/rule IDS that detect malicious software by inspecting the content of packets or files looking for a “signature” labeling malware. They are often very efficient, but their drawback stands in the weakness of the information to check (eg, the signature), which may be quickly dated, and in the computation time because each packet or file needs to be inspected. The IDS based on anomaly detection and, in particular, on statistical analysis have been originated to bypass the mentioned problems. Instead of inspecting packets, each traffic flow is observed so getting a statistical characterization, which represents the fingerprint of the flow. This paper introduces a statistical analysis based intrusion detection system, which, after extracting the statistical fingerprint, uses machine learning classifiers to decide whether a flow is affected by malware or not. A large set of tests is presented. The obtained results allow selecting the best classifiers and show the performance of a decision maker that exploits the decisions of a bank of classifiers acting in parallel.

show abstract

“…Under a filter approach, an objective function evaluates features by their information content and estimates their expected contribution to the classification task. In [26], the authors applied a prefiltering technique using eigen vectors that can reduce the feature set and therefore reduce the training effort. Since our data is binary, a feature selection algorithm that is more suitable for nominal data is preferred.…”

Section: Data and Feature Selectionmentioning

confidence: 99%