Abstract:Malware has recently grown exponentially in recent years and poses a serious threat to individual users, corporations, banks, and government agencies. This can be seen from the growth of Advanced Persistent Threats (APTs) that make use of advance and sophisticated malware. With the wide availability of computer-automated tools such as constructors, email flooders, and spoofers. Thus, it is now easy for users who are not technically inclined to create variations in existing malware. Researchers have developed various defense techniques in response to these threats, such as static and dynamic malware analyses. These techniques are ineffective at detecting new malware in the main memory of the computer and otherwise require considerable effort and domain-specific expertise. Moreover, recent techniques of malware detection require a long time for training and occupy a large amount of memory due to their reliance on multiple factors. In this paper, we propose a computer vision-based technique for detecting malware that resides in the main computer memory in which our technique is faster or memory efficient. It works by taking portable executables in a virtual environment to extract memory dump files from the volatile memory and transform them into a particular image format. The computer vision-based contrast-limited adaptive histogram equalization and the wavelet transform are used to improve the contrast of neighboring pixel and to reduce the entropy. We then use the support vector machine, random forest, decision tree, and XGBOOST machine learning classifiers to train the model on the transformed images with dimensions of 112 × 112 and 56 × 56. The proposed technique was able to detect and classify malware with an accuracy rate of 97.01%. Its precision, recall, and F1-score were 97.36%, 95.65%, and 96.36%, respectively. Our finding shows that our technique in preparing dataset with more efficient features to be trained by the Machine Learning classifiers has resulted in significant performance in terms of accuracy, precision, recall, F1-score, speed and memory consumption. The performance has superseded most of the existing techniques in its unique approach.

Detecting Malware and Rootkit Via Memory Forensics

Defense of Hidden Backdoor Technology for Web

Early Detection of In-Memory Malicious Activity based on Run-time Environmental Features

In-execution dynamic malware analysis and detection by mining information in process control blocks of Linux OS

A Malware Detection Approach based on Deep Learning and Memory Forensics

Research of Rootkit Technology and Detection Method

TKRD: Trusted kernel rootkit detection for cybersecurity of VMs based on machine learning and memory forensic analysis

Detective: Automatically Identify and Analyze Malware Processes in Forensic Scenarios Via DLLs

Enhancing Linux System Security: A Kernel-Based Approach to Fileless Malware Detection and Mitigation

The Reversing Machine: Reconstructing Memory Assumptions

A new approach for detecting process injection attacks using memory analysis

Process based volatile memory forensics for ransomware detection

Memory Forensics-Based Malware Detection Using Computer Vision and Machine Learning

Malware Detection Approach Based on Artifacts in Memory Image and Dynamic Analysis

MEMORY FEATURE ENGINEERING TOWARDS DETECTING OBFUSCATED MALWARE

Malware Detection Based on Multi-level and Dynamic Multi-feature Using Ensemble Learning at Hypervisor

Malware Analysis Using Machine Learning and Deep Learning Techniques

Machine Learning-based Ransomware Detection Using Low-level Memory Access Patterns Obtained From Live-forensic Hypervisor

Malware Detection and Tracer Approach for Operating System

Discovering Encrypted Bot and Ransomware Payloads Through Memory Inspection Without A Priori Knowledge

MRm-DLDet: a memory-resident malware detection framework based on memory forensics and deep neural network