Authors: | Zhang, Shuhui Hu, Changdong Wang, Lianhai Mihaljević, Miodrag J. Xu, Shujiang Lan, Tian |
Affiliations: | Computer Science Mathematical Institute of the Serbian Academy of Sciences and Arts |
Title: | A Malware Detection Approach Based on Deep Learning and Memory Forensics | Journal: | Symmetry | Volume: | 15 | Issue: | 3 | First page: | 758 | Issue Date: | 2023 | Rank: | ~M22 | ISSN: | 2073-8994 | DOI: | 10.3390/sym15030758 | Abstract: | As cyber attacks grow more complex and sophisticated, new types of malware become more dangerous and challenging to detect. In particular, fileless malware injects malicious code into the physical memory directly without leaving attack traces on disk files. This type of attack is well concealed, and it is difficult to find the malicious code in the static files. For malicious processes in memory, signature-based detection methods are becoming increasingly ineffective. Facing these challenges, this paper proposes a malware detection approach based on convolutional neural network and memory forensics. As the malware has many symmetric features, the saved training model can detect malicious code with symmetric features. The method includes collecting executable static malicious and benign samples, running the collected samples in a sandbox, and building a dataset of portable executables in memory through memory forensics. When a process is running, not all the program content is loaded into memory, so binary fragments are utilized for malware analysis instead of the entire portable executable (PE) files. PE file fragments are selected with different lengths and locations. We conducted several experiments on the produced dataset to test our model. The PE file with 4096 bytes of header fragment has the highest accuracy. We achieved a prediction accuracy of up to 97.48%. Moreover, an example of fileless attack is illustrated at the end of the paper. The results show that the proposed method can detect malicious codes effectively, especially the fileless attack. Its accuracy is better than that of common machine learning methods. |
Keywords: | deep learning | malware detection | memory dump | memory forensic | segment detection | Publisher: | MDPI |
Files in This Item:
File | Description | Size | Format | |
---|---|---|---|---|
MMihaljevic.pdf | 3.72 MB | Adobe PDF | View/Open |
SCOPUSTM
Citations
11
checked on Sep 7, 2024
Download(s)
6
checked on Sep 7, 2024
Google ScholarTM
Check
Altmetric
Altmetric
This item is licensed under a Creative Commons License