ntvНаучно-технический вестник информационных технологий, механики и оптикиScientific and Technical Journal of Information Technologies, Mechanics and Optics2226-14942500-0373Университет ИТМО10.17586/2226-1494-2024-24-5-849-857ntv-156Research ArticleКОМПЬЮТЕРНЫЕ СИСТЕМЫ И ИНФОРМАЦИОННЫЕ ТЕХНОЛОГИИCOMPUTER SCIENCEОбнаружение скрытого вредоносного программного обеспечения с использованием глубокой нейронной сети с выбором признаков ANOVA на наборе данных CIC-MalMem-2022Obfuscated malware detection using deep neural network with ANOVA feature selection on CIC-MalMem-2022 datasethttps://orcid.org/0000-0002-6554-3925ХаджилаМ.HadjilaM.

Хаджила Мурад - доктор наук, преподаватель-исследователь

Тлемсен, 13000

Mourad Hadjila - D.Sc., Lecturer-Researcher

Tlemcen, 13000

mhadjila.2009@gmail.comhttps://orcid.org/0009-0002-9117-047XМерзугМ.MerzougM.

Мерзуг Мохаммед - доктор наук, преподаватель-исследователь

Тлемсен, 13000

Mohammed Merzoug - D.Sc., Lecturer-Researcher

Tlemcen, 13000

mohammed.merzoug@univ-tlemcen.dzhttps://orcid.org/0009-0005-7574-8368ФерхиВ.FerhiW.

Ферхи Вафа - аспирант

Тлемсен, 13000

Wafaa Ferhi - PhD Student

Tlemcen, 13000

wafaa.ferhi@univ-tlemcen.dzМуссауиДж.MoussaouiD.

Муссауи Джилали - доктор наук, преподаватель-исследователь

Тлемсен, 13000

Djillali Moussaoui - D.Sc., Lecturer-Researcher

Tlemcen, 13000

djilali.moussaoui@univ-tlemcen.dzhttps://orcid.org/0009-0005-2204-9117БуйденА. Б.BouidaineA. B.

Буйден Аль Бараа - аспирант

Тлемсен, 13000

Al Baraa Bouidaine - PhD Student

Tlemcen, 13000

albaraa.bouidaine@univ-tlemcen.dzhttps://orcid.org/0000-0003-3967-6609ХашемиМ. Х.HachemiM. H.

Хашеми Мохаммед Хишам - доктор наук, преподаватель-исследователь

Оран, 31000

Mohammed Hicham Hachemi - D.Sc., Lecturer-Researcher

Oran, 31000

hicham.hachemi@univ-usto.dzУниверситет ТлемсенаАлжирUniversity of TlemcenAlgeriaУниверситет ОранаРоссияUniversity of OranRussian Federation202414122024245849857Copyright © Хаджила М., Мерзуг М., Ферхи В., Муссауи Д., Буйден А.Б., Хашеми М.Х., 20242024Хаджила М., Мерзуг М., Ферхи В., Муссауи Д., Буйден А.Б., Хашеми М.Х.Hadjila M., Merzoug M., Ferhi W., Moussaoui D., Bouidaine A.B., Hachemi M.H.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://ntv.elpub.ru/jour/article/view/156

Анализ вредоносного программного обеспечения включает исследование функциональности, поведения и потенциальных рисков. Искусственный интеллект и глубокое обучение открывают возможности автоматизированного, интеллектуального и адаптивного анализа вредоносного программного обеспечения. В работе предлагается модель глубокой нейронной сети (Deep Neural Network, DNN), созданная на основе признаков, выбранных с помощью F-теста дисперсионного анализа (ANalysis Of VAriance, ANOVA), для повышения точности распознавания путем выявления информативных признаков. DNN-ANOVA представляет собой метод выбора признаков, используемый для анализа числовых входных данных, когда целевая переменная является категориальной. К наиболее релевантным признакам относятся те, значения оценки которых превышают определенный порог, равный отношению суммы оценок всех признаков к общему числу признаков. Эксперименты выполнены на наборе данных CIC-MalMem-2022. Проведен анализ обнаружения или отсутствия вредоносного программного обеспечения с использованием бинарной классификации, а также полиномиальной классификации для определения его типа. Согласно результатам F-теста, модель DNN-ANOVA достигает наилучших значений: 100 % — precision, 99,99 % — accuracy, 99, 99 % — F1-score и 99,98 % — recall для бинарной классификации. Кроме того, DNN-ANOVA превосходит текущие работы с общим показателем точности (accuracy) 85,83 % для групповых атак и 73,98 % для индивидуальных атак в случае полиномиальной классификации.

Malware analysis is the process of dissecting malicious software to understand its functionality, behavior, and potential risks. Artificial Intelligence (AI) and deep learning are ushering in a new era of automated, intelligent, and adaptive malware analysis. This convergence of AI and deep learning promises to revolutionize the way cybersecurity professionals detect, analyze and respond to malware threats. This paper proposed a Deep Neural Network (DNN) model built from features selected by ANalysis Of Variance (ANOVA) F-test (DNN-ANOVA) to increase accuracy by identifying informative features. ANOVA is a feature selection method used for numerical input data when the target variable is categorical. The top k most relevant features are those whose score values are greater than a certain threshold equal to the ratio between the sum of all features scores and the total number of features. Experiments are conducted on CIC-MalMem-2022 dataset. Malware Analysis is performed using binary classification to detect the presence or absence of malware and multiclass classification to detect not only the malware but also its type. According to the test results, DNN-ANOVA model achieves best values of 100 %, 99.99 %, 99.99 %, and 99.98 % in terms of precision, accuracy, F1-score and recall respectively for binary classification. In addition, DNN-ANOVA outperforms the current works with an overall accuracy rate of 85.83 %, and 73.98 % for family attacks and individual attacks respectively in the case of multiclass classification.

обнаружение вредоносного программного обеспеченияглубокое обучениевыбор признаков ANOVAбинарная классификацияполиномиальная классификациянабор данныхmalware detectiondeep learningANOVA feature selectionbinary classificationReferencesKramer S., Bradfield J.C. A general definition of malware. Journal in Computer Virology, 2010, vol. 6, no. 2, pp. 105–114. https://doi.org/10.1007/s11416-009-0137-1Kramer S., Bradfield J.C. A general definition of malware // Journal in Computer Virology. 2010. V. 6. N 2. P. 105–114. https://doi.org/10.1007/s11416-009-0137-1Li C., Gaudiot J.L. Detecting malicious attacks exploiting hardware vulnerabilities using performance counters. Proc. of the 2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC). V. 1, 2019, pp. 588–597. https://doi.org/10.1109/compsac.2019.00090Li C., Gaudiot J.L. Detecting malicious attacks exploiting hardware vulnerabilities using performance counters // Proc. of the 2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC). V. 1. 2019. P. 588–597. https://doi.org/10.1109/compsac.2019.00090Sinanovic H., Mrdovic S. Analysis of Mirai malicious software. Proc. of the 25th International Conference on Software, Telecommunications and Computer Networks (SoftCOM), 2017, pp. 1–5. https://doi.org/10.23919/softcom.2017.8115504Sinanovic H., Mrdovic S. Analysis of Mirai malicious software // Proc. of the 25th International Conference on Software, Telecommunications and Computer Networks (SoftCOM). 2017. P. 1–5. https://doi.org/10.23919/softcom.2017.8115504Singh R., Kumar H., Singla R.K., Ketti R.R. Internet attacks and intrusion detection system: A review of the literature. Online Information Review, 2017, vol. 41, no. 2, pp. 171–184. https://doi.org/10.1108/oir-12-2015-0394Singh R., Kumar H., Singla R.K., Ketti R.R. Internet attacks and intrusion detection system: A review of the literature // Online Information Review. 2017. V. 41. N 2. P. 171–184. https://doi.org/10.1108/oir-12-2015-0394Yadav B., Tokekar S. Deep learning in malware identification and classification. Malware Analysis Using Artificial Intelligence and Deep Learning. Springer, Cham, 2021, pp. 163–205. https://doi.org/10.1007/978-3-030-62582-5_6Yadav B., Tokekar S. Deep learning in malware identification and classification // Malware Analysis Using Artificial Intelligence and Deep Learning. Springer, Cham, 2021. P. 163–205. https://doi.org/10.1007/978-3-030-62582-5_6Kertysova K., Frinking E., van den Dool K., Maricic A., Bhattacharyya K. Cybersecurity: Ensuring awareness and resilience of the private sector across Europe in face of mounting cyber risks-Study. Bruxelles, Belgium, European Economic and Social Committee, 2018.Kertysova K., Frinking E., van den Dool K., Maricic A., Bhattacharyya K. Cybersecurity: Ensuring awareness and resilience of the private sector across Europe in face of mounting cyber risks-Study. Bruxelles, Belgium: European Economic and Social Committee, 2018.Gopinath M., Sethuraman S.C. A comprehensive survey on deep learning based malware detection techniques. Computer Science Review, 2023, vol. 47, pp. 100529. https://doi.org/10.1016/j.cosrev.2022.100529Gopinath M., Sethuraman S.C. A comprehensive survey on deep learning based malware detection techniques // Computer Science Review. 2023. V. 47. P. 100529. https://doi.org/10.1016/j.cosrev.2022.100529Faruk M.J.H., Shahriar H., Valero M., Barsha F.L., Sobhan S., Khan M.A., Whitman M., Cuzzocrea A., Lo D., Rahman A., Wu F. Malware detection and prevention using artificial intelligence techniques. Proc. of the IEEE International Conference on Big Data (Big Data), 2021, pp. 5369–5377. https://doi.org/10.1109/bigdata52589.2021.9671434Faruk M.J.H., Shahriar H., Valero M., Barsha F.L., Sobhan S., Khan M.A., Whitman M., Cuzzocrea A., Lo D., Rahman A., Wu F. Malware detection and prevention using artificial intelligence techniques // Proc. of the IEEE International Conference on Big Data (Big Data). 2021. P. 5369–5377. https://doi.org/10.1109/bigdata52589.2021.9671434Vigna G. How AI will help in the fight against malware. Retrieved from TechBeacon, 2020.Vigna G. How AI will help in the fight against malware // Retrieved from TechBeacon. 2020.Schmitt M. Securing the Digital World: Protecting smart infrastructures and digital industries with Artificial Intelligence (AI)- enabled malware and intrusion detection. Journal of Industrial Information Integration, 2023, vol. 36, pp. 100520. https://doi.org/10.1016/j.jii.2023.100520Schmitt M. Securing the Digital World: Protecting smart infrastructures and digital industries with Artificial Intelligence (AI)- enabled malware and intrusion detection // Journal of Industrial Information Integration. 2023. V. 36. P. 100520. https://doi.org/10.1016/j.jii.2023.100520Aljabri M., Alhaidari F., Albuainain A., Alrashidi S., Alansari J., Alqahtani W., Alshaya J. Ransomware detection based on machine learning using memory features. Egyptian Informatics Journal, 2024, vol. 25, pp. 100445. https://doi.org/10.1016/j.eij.2024.100445Aljabri M., Alhaidari F., Albuainain A., Alrashidi S., Alansari J., Alqahtani W., Alshaya J. Ransomware detection based on machine learning using memory features // Egyptian Informatics Journal. 2024. V. 25. P. 100445. https://doi.org/10.1016/j.eij.2024.100445Ababneh M., Aljarrah A. Cybersecurity: Malware multi-attack detector on android-based devices using deep learning methods. Journal of Theoretical and Applied Information Technology, 2024, vol. 102, no. 1, pp. 144–166.Ababneh M., Aljarrah A. Cybersecurity: Malware multi-attack detector on android-based devices using deep learning methods // Journal of Theoretical and Applied Information Technology. 2024. V. 102. N 1. P. 144–166.Majid A.A.M., Alshaibi A.J., Kostyuchenko E., Shelupanov A. A review of artificial intelligence based malware detection using deep learning. Materials Today: Proceedings, 2023, vol. 80, part 3, pp. 2678–2683. https://doi.org/10.1016/j.matpr.2021.07.012Majid A.A.M., Alshaibi A.J., Kostyuchenko E., Shelupanov A. A review of artificial intelligence based malware detection using deep learning // Materials Today: Proceedings. 2023. V. 80. Part 3. P. 2678–2683. https://doi.org/10.1016/j.matpr.2021.07.012Riaz S., Latif S., Usman S.M., Ullah S.S., Algarni A.D., Yasin A., Anwar A., Elmannai H., Hussain S. Malware Detection in Internet of Things (IoT) devices using deep learning. Sensors, 2022, vol. 22, no. 23, pp. 9305. https://doi.org/10.3390/s22239305Riaz S., Latif S., Usman S.M., Ullah S.S., Algarni A.D., Yasin A., Anwar A., Elmannai H., Hussain S. Malware Detection in Internet of Things (IoT) devices using deep learning // Sensors. 2022. V. 22. N 23. P. 9305. https://doi.org/10.3390/s22239305Xing X., Jin X., Elahi H., Jiang H., Wang G. A malware detection approach using autoencoder in deep learning. IEEE Access, 2022, vol. 10, pp. 25696–25706. https://doi.org/10.1109/access.2022.3155695Xing X., Jin X., Elahi H., Jiang H., Wang G. A malware detection approach using autoencoder in deep learning // IEEE Access. 2022. V. 10. P. 25696–25706. https://doi.org/10.1109/access.2022.3155695Ucci D., Aniello L., Baldoni R. Survey of machine learning techniques for malware analysis. Computers & Security, 2019, vol. 81, pp. 123–147. https://doi.org/10.1016/j.cose.2018.11.001Ucci D., Aniello L., Baldoni R. Survey of machine learning techniques for malware analysis // Computers & Security. 2019. V. 81. P. 123–147. https://doi.org/10.1016/j.cose.2018.11.001Shafin S.S., Karmakar G., Mareels I. Obfuscated memory malware detection in resource-constrained IoT devices for smart city applications. Sensors, 2023, vol. 23, no. 11, pp. 5348. https://doi.org/10.3390/s23115348Shafin S.S., Karmakar G., Mareels I. Obfuscated memory malware detection in resource-constrained IoT devices for smart city applications // Sensors. 2023. V. 23. N 11. P. 5348. https://doi.org/10.3390/s23115348Mezina A., Burget R. Obfuscated malware detection using dilated convolutional network. Proc. of the 14th International Congress on Ultra Modern Telecommunications and Control Systems and Workshops (ICUMT), 2022, pp. 110–115. https://doi.org/10.1109/icumt57764.2022.9943443Mezina A., Burget R. Obfuscated malware detection using dilated convolutional network // Proc. of the 14th International Congress on Ultra Modern Telecommunications and Control Systems and Workshops (ICUMT). 2022. P. 110–115. https://doi.org/10.1109/icumt57764.2022.9943443Brownlee J. How to perform feature selection with numerical input data. Machine Learning Mastery, 2020.Brownlee J. How to perform feature selection with numerical input data // Machine Learning Mastery. 2020.Brownlee J. How to choose a feature selection method for machine learning. Machine Learning Mastery, 2019.Brownlee J. How to choose a feature selection method for machine learning // Machine Learning Mastery. 2019.Cai J., Luo J., Wang S., Yang S. Feature selection in machine learning: A new perspective. Neurocomputing, 2018, vol. 300, pp. 70–79. https://doi.org/10.1016/j.neucom.2017.11.077Cai J., Luo J., Wang S., Yang S. Feature selection in machine learning: A new perspective // Neurocomputing. 2018. V. 300. P. 70–79. https:// doi.org/10.1016/j.neucom.2017.11.077Payton A.M. A review of spyware campaigns and strategies to combat them. Proc. of the 3rd Annual Conference on Information Security Curriculum Development, 2006, pp. 136–141. https://doi.org/10.1145/1231047.1231077Payton A.M. A review of spyware campaigns and strategies to combat them // Proc. of the 3rd Annual Conference on Information Security Curriculum Development. 2006. P. 136–141. https://doi.org/10.1145/1231047.1231077Carrier T., Victor P., Tekeoglu A., Lashkari A. Detecting obfuscated malware using memory feature engineering. Proc. of the 8th International Conference on Information Systems Security and Privacy ICISSP. V. 1, 2022, pp. 177–188. https://doi.org/10.5220/0010908200003120Carrier T., Victor P., Tekeoglu A., Lashkari A. Detecting obfuscated malware using memory feature engineering // Proc. of the 8th International Conference on Information Systems Security and Privacy ICISSP. V. 1. 2022. P. 177–188. https://doi.org/10.5220/0010908200003120Mallikarajunan K.N., Preethi S.R., Selvalakshmi S., Nithish N. Detection of spyware in software using virtual environment. Proc. of the 3rd International Conference on Trends in Electronics and Informatics (ICOEI), 2019, pp. 1138–1142. https://doi.org/10.1109/icoei.2019.8862547Mallikarajunan K.N., Preethi S.R., Selvalakshmi S., Nithish N. Detection of spyware in software using virtual environment // Proc. of the 3rd International Conference on Trends in Electronics and Informatics (ICOEI). 2019. P. 1138–1142. https://doi.org/10.1109/icoei.2019.8862547Jonasson D., Sigholm J. What is Spyware?. TDDC03 Projects, Department of Computer and Information Science. Sewden, Linkopings University, 2005.Jonasson D., Sigholm J. What is Spyware?. TDDC03 Projects, Department of Computer and Information Science. Sewden: Linkopings University, 2005.Pelchen-Matthews A., Raposo G., Marsh M. Endosomes, exosomes and Trojan viruses. Trends in Microbiology, 2004, vol. 12, no. 7, pp. 310–316. https://doi.org/10.1016/j.tim.2004.05.004Pelchen-Matthews A., Raposo G., Marsh M. Endosomes, exosomes and Trojan viruses // Trends in Microbiology. 2004. V. 12. N 7. P. 310–316. https://doi.org/10.1016/j.tim.2004.05.004Liu Y., Mondal A., Chakraborty A., Zuzak M., Jacobsen N., Xing D., Srivastava A. A survey on neural trojans. Proc. of the 21st International Symposium on Quality Electronic Design (ISQED), 2020, pp. 33–39. https://doi.org/10.1109/isqed48828.2020.9137011Liu Y., Mondal A., Chakraborty A., Zuzak M., Jacobsen N., Xing D., Srivastava A. A survey on neural trojans // Proc. of the 21st International Symposium on Quality Electronic Design (ISQED). 2020. P. 33–39. https://doi.org/10.1109/isqed48828.2020.9137011Brewer R. Ransomware attacks: detection, prevention and cure. Network Security, 2016, vol. 2016, no. 9, pp. 5–9. https://doi.org/10.1016/s1353-4858(16)30086-1Brewer R. Ransomware attacks: detection, prevention and cure // Network Security. 2016. V. 2016. N 9. P. 5–9. https://doi.org/10.1016/s1353-4858(16)30086-1Tuttle H. Ransomware attackers turn to double extortion. Risk Management, 2021, vol. 68, no. 2, pp. 8–9.Tuttle H. Ransomware attackers turn to double extortion // Risk Management. 2021. V. 68. N 2. P. 8–9.Nershi K., Grossman S. Assessing the Political Motivations Behind Ransomware Attacks. SSRN Electronic Journal, 2023. https://doi.org/10.2139/ssrn.4507111Nershi K., Grossman S. Assessing the Political Motivations Behind Ransomware Attacks // SSRN Electronic Journal. 2023. https://doi.org/10.2139/ssrn.4507111Casas P., Blancas J., Villanueva A. Ransomware Report 2023: targets, motives, and trends. Outpost24. 07 Feb. 2023. Available: https:// outpost24.com/blog/ransomware-report-2023- targets-motives-andtrends/(accessed: 01.08.2024).Casas P., Blancas J., Villanueva A. Ransomware Report 2023: targets, motives, and trends // Outpost24. 07 Feb. 2023 [Электронный ресурс]. URL: https://outpost24.com/blog/ransomware-report-2023-targets-motives-and-trends/ (дата обращения: 01.08.2024).Sawyer S.F. Analysis of variance: the fundamental concepts. Journal of Manual & Manipulative Therapy, 2009, vol. 17, no. 2, pp. 27E–38E. https://doi.org/10.1179/jmt.2009.17.2.27eSawyer S.F. Analysis of variance: the fundamental concepts // Journal of Manual & Manipulative Therapy. 2009. V. 17. N 2. P. 27E–38E. https://doi.org/10.1179/jmt.2009.17.2.27e

The authors declare that there are no conflicts of interest present.