XMal: A lightweight memory-based explainable obfuscated-malware detector

被引：10
作者：
Alani M.M. [1 ,2 ]
Mashatan A. [1 ]
Miri A. [3 ]
机构：
[1] Cybersecurity Research Lab, Toronto Metropolitan University, Toronto
[2] School of IT Administration and Security, Seneca College of Applied Arts and Technology, Toronto
[3] Computer Science Department, Toronto Metropolitan University, Toronto
来源：
Computers and Security | 2023年 / 133卷
基金：
加拿大自然科学与工程研究理事会;
关键词：
Explainable machine learning; Machine learning; Malware; Malware detection; Obfuscated malware;
D O I：
10.1016/j.cose.2023.103409
中图分类号：
学科分类号：
摘要：
An average of 560,000 new malware instances are being detected every day. Malware detection is becoming one of the biggest challenges in the field of computer security. The use of code obfuscation techniques by malicious actors is gaining popularity, further complicating the process of detection. In this paper, we introduce a lightweight obfuscated-malware detector based on machine learning that is also explainable. The proposed method, based on extreme gradient boost, employs only five features extracted from memory dumps, achieving a detection accuracy of over 99%. These five features were selected using recursive feature elimination, based on feature importance. Through testing, we demonstrated that the system was capable of detecting malware instances in just 0.413 μs. The model was explained using Shapley additive explanations. © 2023 Elsevier Ltd
引用
收藏
相关论文
共 47 条
  • [1] Ahlashkari, VolMemLyzer, (2022)
  • [2] Alani M.M., Big data in cybersecurity: a survey of applications and future trends, J. Reliab. Intell. Environ., 7, 2, pp. 85-114, (2021)
  • [3] Alani M.M., Awad A.I., Paired: an explainable lightweight Android malware detection system, IEEE Access, 10, pp. 73214-73228, (2022)
  • [4] Ali Z., Soomro T.R., An efficient mining based approach using pso selection technique for analysis and detection of obfuscated malware, J. Inf. Assur. Cyber Secur., 2018, pp. 1-13, (2018)
  • [5] Aslan O.A., Samet R., A comprehensive review on malware detection approaches, IEEE Access, 8, pp. 6249-6271, (2020)
  • [6] (2022)
  • [7] Bacci A., Bartoli A., Martinelli F., Medvet E., Mercaldo F., Visaggio C.A., Impact of code obfuscation on Android malware detection based on static and dynamic analysis, ICISSP, pp. 379-385, (2018)
  • [8] Barr-Smith F., Ugarte-Pedrero X., Graziano M., Spolaor R., Martinovic I., Survivalism: systematic analysis of windows malware living-off-the-land, 2021 IEEE Symposium on Security and Privacy (SP), pp. 1557-1574, (2021)
  • [9] Carrier T., Victor P., Tekeoglu A., Lashkari A., Detecting obfuscated malware using memory feature engineering, Proceedings of the 8th International Conference on Information Systems Security and Privacy - ICISSP, INSTICC, pp. 177-188, (2022)
  • [10] Cisco Umbrella, Cybersecurity threat trends: phishing, crypto top the list, (2022)
12345