Scholarlink

<p>Malware forensics is a field in digital forensics that is dedicated to collecting evidence of a malware attack on a system. Malware is also executable code, but unlike regular executables, it is designed to perform unauthorized actions on victim computers. Being an executable, the malware also performs designated tasks through several processes that can leave its traces (digital footprints) throughout different components of the operating system, such as registries, file systems, DLL calls, API calls, memory usage, CPU utilization, network traffic, etc. Some of these traces can exist even after the removal of the malware and can be used as evidence to verify the occurrence of an attack. The proposed malware forensic analysis technique combines both the static and dynamic features of the malware to trace its evidence. This information is collected using the Cuckoo sandbox, which executes the malware sample files in a virtual environment to generate a JSON-formatted analysis report. The Python script is used to extract the non-volatile features from the JSON format analysis report. However, combining both features results in a very long and sparse feature vector, which negatively affects the classifier’s performance. Therefore, the principal component analysis (PCA) algorithm is adopted to reduce the dimensionality of the feature vectors. The generated reduced dimensionality feature vectors are used to train the extreme learning machine (ELM). The ELM can be trained in a fraction of the time compared to the support vector machine (SVM), while achieving similar accuracy. This makes it a favorable choice, especially for malware forensic analysis, where the classifier needs to train with a large amount of data and requires quick decision-making capabilities. The performance of the proposed techniques is evaluated using 90 malicious code samples containing 41 Trojans, 28 worms, and 21 bots. To demonstrate the superiority of the proposed algorithm, a comparison with some state-of-the-art classification methods, named Hidden Markov Model (HMM), Support Vector Machine (SVM), Artificial Neural Network (ANN), and ELM, was also performed. The comparison results show that the proposed technique achieves approximately 11% higher precision, 10% higher recall, and a 10.5% higher F-score than the competitors.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Detecting malware evidences through static and dynamic information using extreme machine learning for forensic analysis

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2025年12月27日

查看全文
  • Rijvan Beg,
  • R. K. Pateriya,
  • Deepak Singh Tomar,
  • Surendra Solanki

摘要

Malware forensics is a field in digital forensics that is dedicated to collecting evidence of a malware attack on a system. Malware is also executable code, but unlike regular executables, it is designed to perform unauthorized actions on victim computers. Being an executable, the malware also performs designated tasks through several processes that can leave its traces (digital footprints) throughout different components of the operating system, such as registries, file systems, DLL calls, API calls, memory usage, CPU utilization, network traffic, etc. Some of these traces can exist even after the removal of the malware and can be used as evidence to verify the occurrence of an attack. The proposed malware forensic analysis technique combines both the static and dynamic features of the malware to trace its evidence. This information is collected using the Cuckoo sandbox, which executes the malware sample files in a virtual environment to generate a JSON-formatted analysis report. The Python script is used to extract the non-volatile features from the JSON format analysis report. However, combining both features results in a very long and sparse feature vector, which negatively affects the classifier’s performance. Therefore, the principal component analysis (PCA) algorithm is adopted to reduce the dimensionality of the feature vectors. The generated reduced dimensionality feature vectors are used to train the extreme learning machine (ELM). The ELM can be trained in a fraction of the time compared to the support vector machine (SVM), while achieving similar accuracy. This makes it a favorable choice, especially for malware forensic analysis, where the classifier needs to train with a large amount of data and requires quick decision-making capabilities. The performance of the proposed techniques is evaluated using 90 malicious code samples containing 41 Trojans, 28 worms, and 21 bots. To demonstrate the superiority of the proposed algorithm, a comparison with some state-of-the-art classification methods, named Hidden Markov Model (HMM), Support Vector Machine (SVM), Artificial Neural Network (ANN), and ELM, was also performed. The comparison results show that the proposed technique achieves approximately 11% higher precision, 10% higher recall, and a 10.5% higher F-score than the competitors.