Abstract:Malware is one of the most significant threats in today’s computing world since the number of websites distributing malware is increasing at a rapid rate. Malware analysis and prevention methods are increasingly becoming necessary for computer systems connected to the Internet. This software exploits the system’s vulnerabilities to steal valuable information without the user’s knowledge, and stealthily send it to remote servers controlled by attackers. Traditionally, anti-malware products use signatures for detecting known malware. However, the signature-based method does not scale in detecting obfuscated and packed malware. Considering that the cause of a problem is often best understood by studying the structural aspects of a program like the mnemonics, instruction opcode, API Call, etc. In this paper, we investigate the relevance of the features of unpacked malicious and benign executables like mnemonics, instruction opcodes, and API to identify a feature that classifies the executable. Prominent features are extracted using Minimum Redundancy and Maximum Relevance (mRMR) and Analysis of Variance (ANOVA). Experiments were conducted on four datasets using machine learning and deep learning approaches such as Support Vector Machine (SVM), Naïve Bayes, J48, Random Forest (RF), and XGBoost. In addition, we also evaluate the performance of the collection of deep neural networks like Deep Dense network, One-Dimensional Convolutional Neural Network (1D-CNN), and CNN-LSTM in classifying unknown samples, and we observed promising results using APIs and system calls. On combining APIs/system calls with static features, a marginal performance improvement was attained comparing models trained only on dynamic features. Moreover, to improve accuracy, we implemented our solution using distinct deep learning methods and demonstrated a fine-tuned deep neural network that resulted in an F1-score of 99.1% and 98.48% on Dataset-2 and Dataset-3, respectively.

Detection and classification of malicious JavaScript via attack behavior modelling

Malicious JavaScript Code Detection Based on Hybrid Analysis

A deep learning approach for detecting malicious JavaScript code

JStill: mostly static detection of obfuscated malicious JavaScript code

Detection of Obfuscated Malicious JavaScript Code

JStrong: Malicious JavaScript detection based on code semantic representation and graph neural network

Understanding the Influence of AST-JS for Improving Malicious Webpage Detection

Detection and analysis of malicious JavaScript code based on pre-filter

Statically Detecting JavaScript Obfuscation and Minification Techniques in the Wild

Mining Malware Specifications through Static Reachability Analysis

An ensemble framework for interpretable malicious code detection

A malware detection framework based on kolmogorov complexity

Static Semantics Reconstruction for Enhancing JavaScript-WebAssembly Multilingual Malware Detection

Discovering Malicious Signatures in Software from Structural Interactions

JSContana: Malicious JavaScript detection using adaptable context analysis and key feature extraction

Malicious web script-based cyber attack protection technology

An Evasion and Counter-Evasion Study in Malicious Websites Detection

A Hybrid Deep Learning Model for Malicious Behavior Detection

Detective: Automatically Identify and Analyze Malware Processes in Forensic Scenarios Via DLLs

Detection of Malicious Software by Analyzing Distinct Artifacts Using Machine Learning and Deep Learning Algorithms

Capturing the symptoms of malicious code in electronic documents by file's entropy signal combined with Machine learning