Abstract:Abstract Enterprises are striving to remain protected against malware-based cyber-attacks on their infrastructure, facilities, networks and systems. Static analysis is an effective approach to detect the malware, i.e., malicious Portable Executable (PE). It performs an in-depth analysis of PE files without executing, which is highly useful to minimize the risk of malicious PE contaminating the system. Yet, instant detection using static analysis has become very difficult due to the exponential rise in volume and variety of malware. The compelling need of early stage detection of malware-based attacks significantly motivates research inclination towards automated malware detection. The recent machine learning aided malware detection approaches using static analysis are mostly supervised. Supervised malware detection using static analysis requires manual labelling and human feedback; therefore, it is less effective in rapidly evolutionary and dynamic threat space. To this end, we propose a progressive deep unsupervised framework with feature attention block for static analysis-based malware detection (PROUD-MAL). The framework is based on cascading blocks of unsupervised clustering and features attention-based deep neural network. The proposed deep neural network embedded with feature attention block is trained on the pseudo labels. To evaluate the proposed unsupervised framework, we collected a real-time malware dataset by deploying low and high interaction honeypots on an enterprise organizational network. Moreover, endpoint security solution is also deployed on an enterprise organizational network to collect malware samples. After post processing and cleaning, the novel dataset consists of 15,457 PE samples comprising 8775 malicious and 6681 benign ones. The proposed PROUD-MAL framework achieved an accuracy of more than 98.09% with better quantitative performance in standard evaluation parameters on collected dataset and outperformed other conventional machine learning algorithms. The implementation and dataset are available at https://bit.ly/35Sne3a .

Comparison of Support Vector Machine and Random Forest Method on Static Analysis Windows Portable Executable (PE) Malware Detection

Detection Method of Computer Worms Based on SVM

Malware Analysis Using Machine Learning and Deep Learning Techniques

Evaluation of Machine Learning Algorithms for Malware Detection

Malware detection system based on static and dynamic analysis and using machine learning

Machine Learning Aided Static Malware Analysis: A Survey and Tutorial

A Comprehensive Study on Learning-Based PE Malware Family Classification Methods

Random Forest for Malware Classification

Malware Analysis and Detection Using Machine Learning Algorithms

PROUD-MAL: static analysis-based progressive framework for deep unsupervised malware classification of windows portable executable

Machine Learning for Detecting Malware in PE Files

A static analysis approach for Android permission-based malware detection systems

Towards an Automated Pipeline for Detecting and Classifying Malware through Machine Learning

Malicious Code Detection Using Machine Learning

Detection of Malicious Software by Analyzing Distinct Artifacts Using Machine Learning and Deep Learning Algorithms

Automatic Malicious Code Classification System through Static Analysis Using Machine Learning

Advanced Cybersecurity Enhancement through Mathematical Models: A Comprehensive Approach Using Statistical Methods, Cryptographic Techniques, and Machine Learning Algorithms (SVM, Random Forest, and Neural Networks) for Behavior-Based Malware Detection

A malware detection scheme based on mining format information

Two Effective Methods to Detect Mobile Malware

A Novel Malware Detection System Based On Machine Learning and Binary Visualization

Malware Detection and Classification Using Machine Learning Algorithms