Malware Detection Method Based on File and Registry Operations Using Machine Learning

Ömer Aslan; Erdal Akin

doi:10.35377/saucis...1049798

EN

Malware Detection Method Based on File and Registry Operations Using Machine Learning

Abstract

Malware (Malicious Software) is any software which performs malicious activities on computer-based systems without the user's consent. The number, severity, and complexity of malware have been increasing recently. The detection of malware becomes challenging because new malware variants are using obfuscation techniques to hide themselves from the malware detection systems. In this paper, a new behavioral-based malware detection method is proposed based on file-registry operations. When malware features are generated, only the operations which are performed on specific file and registry locations are considered. The file-registry operations divided into five groups: autostart file locations, temporary file locations, specific system file locations, autostart registry locations, and DLLs related registry locations. Based on the file-registry operations and where they performed, the malware features are generated. These features are seen in malware samples with high frequencies, while rarely seen in benign samples. The proposed method is tested on malware and benign samples in a virtual environment, and a dataset is created. Well-known machine learning algorithms including C4.5 (J48), RF (Random Forest), SLR (Simple Logistic Regression), AdaBoost (Adaptive Boosting), SMO (Sequential Minimal Optimization), and KNN (K-Nearest Neighbors) are used for classification. In the best case, we obtained 98.8% true positive rate, 0% false positive rate, 100% precision and 99.05% accuracy which is quite high when compared with leading methods in the literature.

Keywords

References

[1] Ö. Aslan, R. Samet. "Investigation of possibilities to detect malware using existing tools," IEEE/ACS 14th International Conference on Computer Systems and Applications (AICCSA) (pp. 1277-1284), October 2017.
[2] Ö. Aslan and R.Samet. "A comprehensive review on malware detection approaches," IEEE Access, 8, 6249-6271, 2020.
[3] A. Souri and R. Hosseini. "A state-of-the-art survey of malware detection approaches using data mining techniques," Human-centric Computing and Information Sciences, 8(1), 1-22, 2018.
[4] Ö. Aslan, R. Samet and Ö.Ö. Tanrıöver. "Using a Subtractive Center Behavioral Model to Detect Malware, " Security and Communication Networks, 2020, 2020.
[5] J. Nazari. "Defense and Detection Strategies against Internet Worms," Artech House, 2004.
[6] S. Sparks and J. Butler. "Shadow walker: Raising the bar for rootkit detection," Black Hat Japan, 11(63), 504-533, 2005.
[7] K. Savage, P. Coogan, and H. Lau. "The evolution of ransomware," Symantec report, August 2015.
[8] P. Luckett, J. T. McDonald and J. Dawson. "Neural network analysis of system call timing for rootkit detection," Cybersecurity Symposium (CYBERSEC) (pp. 1-6), April 2016.

[9] Ö. Aslan, Ö. "Performance comparison of static malware analysis tools versus antivirus scanners to detect malware," In International Multidisciplinary Studies Congress (IMSC), 2017.
[10]Z. Xu, S. Ray, P. Subramanyan and S. Malik. "Malware detection using machine learning based analysis of virtual memory access patterns," In Design, Automation & Test in Europe Conference & Exhibition (DATE), 2017 (pp. 169-174), March 2017.
[11] N.A. Rosli, W. Yassin, M. A. Faizal and S. R. Selamat. "Clustering Analysis for Malware Behavior Detection using Registry Data," International Journal of Advanced Computer Science and Applications (IJACSA), 10, 12, 2019.
[12] M. B. Bahador, M. Abadi and A. Tajoddin. "HLMD: a signature-based approach to hardware-level behavioral malware detection and classification," The Journal of Supercomputing, 75(8), 5551-5582, 2019.
[13] H. Zhang, W. Zhang, Z. Lv, A. K. Sangaiah, T. Huang and N. Chilamkurti. MALDC: "A depth detection method for malware based on behavior chains," World Wide Web, 23(2), 991-1010, 2020.
[14] Y. Sun, A. K. Bashir, U. Tariq and F. Xiao. "Effective malware detection scheme based on classified behavior graph in IIoT," Ad Hoc Networks, 102558, 2021.
[15] Malware downloading webstie, "https://www.virusign.com/", accessible in 2021.
[16] Malware downloading webstie, "https://malshare.com/", accessible in 2021.
[17] Malware downloading webstie, "http://www.tekdefense.com/", accessible in 2021.

Details

Primary Language

English

Subjects

Computer Software

Journal Section

Research Article

Authors

Ömer Aslan ^*
0000-0003-0737-1966
Türkiye

Erdal Akin
0000-0002-2223-3927
Türkiye

Publication Date

August 31, 2022

Submission Date

December 28, 2021

Acceptance Date

May 25, 2022

Published in Issue

Year 2022 Volume: 5 Number: 2

DOI

https://doi.org/10.35377/saucis...1049798

IZ

https://izlik.org/JA66YD34XN

Cite

RIS / Bibtex

APA

Aslan, Ö., & Akin, E. (2022). Malware Detection Method Based on File and Registry Operations Using Machine Learning. Sakarya University Journal of Computer and Information Sciences, 5(2), 134-146. https://doi.org/10.35377/saucis...1049798

AMA

1.Aslan Ö, Akin E. Malware Detection Method Based on File and Registry Operations Using Machine Learning. SAUCIS. 2022;5(2):134-146. doi:10.35377/saucis.1049798

Chicago

Aslan, Ömer, and Erdal Akin. 2022. “Malware Detection Method Based on File and Registry Operations Using Machine Learning”. Sakarya University Journal of Computer and Information Sciences 5 (2): 134-46. https://doi.org/10.35377/saucis. 1049798.

EndNote

Aslan Ö, Akin E (August 1, 2022) Malware Detection Method Based on File and Registry Operations Using Machine Learning. Sakarya University Journal of Computer and Information Sciences 5 2 134–146.

IEEE

[1]Ö. Aslan and E. Akin, “Malware Detection Method Based on File and Registry Operations Using Machine Learning”, SAUCIS, vol. 5, no. 2, pp. 134–146, Aug. 2022, doi: 10.35377/saucis...1049798.

ISNAD

Aslan, Ömer - Akin, Erdal. “Malware Detection Method Based on File and Registry Operations Using Machine Learning”. Sakarya University Journal of Computer and Information Sciences 5/2 (August 1, 2022): 134-146. https://doi.org/10.35377/saucis. 1049798.

JAMA

1.Aslan Ö, Akin E. Malware Detection Method Based on File and Registry Operations Using Machine Learning. SAUCIS. 2022;5:134–146.

MLA

Aslan, Ömer, and Erdal Akin. “Malware Detection Method Based on File and Registry Operations Using Machine Learning”. Sakarya University Journal of Computer and Information Sciences, vol. 5, no. 2, Aug. 2022, pp. 134-46, doi:10.35377/saucis. 1049798.

Vancouver

1.Ömer Aslan, Erdal Akin. Malware Detection Method Based on File and Registry Operations Using Machine Learning. SAUCIS. 2022 Aug. 1;5(2):134-46. doi:10.35377/saucis. 1049798