Abstract:We are living in an era in which daily interaction between individuals and businesses involves sending, uploading, and sharing videos as a means of communication and advertising. However, many users are unaware of the risks associated with opening a malicious video file, it is thus no surprise that cyber-criminals have taken advantage of this situation and adopted this attack vector in recent years. MP4 is one of the most commonly used video formats, and its properties make it well-suited for software vulnerability exploitation across multiple platforms, which can ultimately lead to a cyberattack. Due to their deterministic, signature-based technique, antivirus software solutions are limited in their ability to detect unknown malware, let alone zero-day attacks. Machine learning (ML) algorithms have been effective in detecting known and unknown malware across various file formats, domains, and platforms. ML algorithms' performance relies heavily on the feature extraction methodology. However, to the best of our knowledge, there is no designated and specialized feature extraction methodology for MP4 files which generates a set of features for the task of unknown MP4 file malware detection. In this paper, we present three innovative and efficient feature extraction methodologies for unknown MP4 file malware detection. Two of them are file structure-based and one is knowledge-based. The methodologies are evaluated in a series of five experiments using six ML algorithms and 177 different datasets which represent different configurations of feature extraction, representation, and selection. The datasets are based on a representative collection of 6,229 files - 5,066 benign (∼81.3%) files and 1,163 malicious files (∼18.7%). The first three experiments demonstrate the methodologies' discrimination and generalization capabilities across multiple configurations, in terms of known and unknown MP4 file malware detection. The fourth experiment shows that applying principal component analysis (PCA) on the features suggested by the methodologies can improve time and space complexity and feature resilience while maintaining strong detection and generalization capabilities. In the fifth experiment, the methodologies' best performing configuration is compared to state-of-the-art, generic feature extraction methodologies, such as n-grams, MinHash, and representation and transfer learning (using a CNN), in the task of unknown MP4 file malware detection. The results show that our best performing configuration outperforms all other state-of-the-art feature extraction methodologies with an AUC, TPR, and FPR of 0.9951, 0.976, and 0.0 respectively.

Fragments-Expert: A Graphical User Interface MATLAB Toolbox for Classification of File Fragments

Building a Dictionary of Image Fragments

File fragment recognition based on content and statistical features

Hierarchy-Based File Fragment Classification

Detecting Image Tampering Using Feature Fusion

Dataset for file fragment classification of textual file formats

A File Fragment Classification Method Based on Grayscale Image.

Dataset for file fragment classification of image file formats

Dataset for file fragment classification of video file formats

File Fragment Type Classification Using Light-Weight Convolutional Neural Networks

SIFT -- File Fragment Classification Without Metadata

Dataset for file fragment classification of audio file formats

File Fragment Classification using Light-Weight Convolutional Neural Networks

FMDiv: Functional Module Division on Binary Malware for Accurate Malicious Code Localization.

File Fragment Classification Using Grayscale Image Conversion and Deep Learning in Digital Forensics

FiFTy: Large-scale File Fragment Type Identification using Neural Networks

SingleFrag: A deep learning tool for MS/MS fragment and spectral prediction and metabolite annotation

Efficient Feature Extraction Methodologies for Unknown MP4-Malware Detection using Machine Learning Algorithms

Toward the Detection of Polyglot Files

ByteNet: Rethinking Multimedia File Fragment Classification through Visual Perspectives

DigFrag as a digital fragmentation method used for artificial intelligence-based drug design