Abstract:Malware is one of the most significant threats in today’s computing world since the number of websites distributing malware is increasing at a rapid rate. Malware analysis and prevention methods are increasingly becoming necessary for computer systems connected to the Internet. This software exploits the system’s vulnerabilities to steal valuable information without the user’s knowledge, and stealthily send it to remote servers controlled by attackers. Traditionally, anti-malware products use signatures for detecting known malware. However, the signature-based method does not scale in detecting obfuscated and packed malware. Considering that the cause of a problem is often best understood by studying the structural aspects of a program like the mnemonics, instruction opcode, API Call, etc. In this paper, we investigate the relevance of the features of unpacked malicious and benign executables like mnemonics, instruction opcodes, and API to identify a feature that classifies the executable. Prominent features are extracted using Minimum Redundancy and Maximum Relevance (mRMR) and Analysis of Variance (ANOVA). Experiments were conducted on four datasets using machine learning and deep learning approaches such as Support Vector Machine (SVM), Naïve Bayes, J48, Random Forest (RF), and XGBoost. In addition, we also evaluate the performance of the collection of deep neural networks like Deep Dense network, One-Dimensional Convolutional Neural Network (1D-CNN), and CNN-LSTM in classifying unknown samples, and we observed promising results using APIs and system calls. On combining APIs/system calls with static features, a marginal performance improvement was attained comparing models trained only on dynamic features. Moreover, to improve accuracy, we implemented our solution using distinct deep learning methods and demonstrated a fine-tuned deep neural network that resulted in an F1-score of 99.1% and 98.48% on Dataset-2 and Dataset-3, respectively.

Supporting the Detection of Software Supply Chain Attacks through Unsupervised Signature Generation

Practical Automated Detection of Malicious npm Packages

SpiderScan: Practical Detection of Malicious NPM Packages Based on Graph-Based Behavior Modeling and Matching

Malicious Package Detection using Metadata Information

On the Feasibility of Cross-Language Detection of Malicious Packages in npm and PyPI

DONAPI: Malicious NPM Packages Detector using Behavior Sequence Knowledge Mapping

Discovering Malicious Signatures in Software from Structural Interactions

What are Weak Links in the npm Supply Chain?

Towards Using Source Code Repositories to Identify Software Supply Chain Attacks

Towards Robust Detection of Open Source Software Supply Chain Poisoning Attacks in Industry Environments

Automated Synthesis of Semantic Malware Signatures using Maximum Satisfiability

MalWuKong: Towards Fast, Accurate, and Multilingual Detection of Malicious Code Poisoning in OSS Supply Chains

Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks

PackageIntel: Leveraging Large Language Models for Automated Intelligence Extraction in Package Ecosystems

Detection of Malicious Software by Analyzing Distinct Artifacts Using Machine Learning and Deep Learning Algorithms

SCORE: Syntactic Code Representations for Static Script Malware Detection

Component Similarity Based Methods for Automatic Analysis of Malicious Executables

Killing Two Birds with One Stone: Malicious Package Detection in NPM and PyPI Using a Single Model of Malicious Behavior Sequence

Mining Malware Specifications through Static Reachability Analysis

A Machine Learning-Based Approach For Detecting Malicious PyPI Packages

Unsupervised Detection and Clustering of Malicious TLS Flows