Empirical Review and Comparative Analysis of Machine Learning Models in Malware Detection
Keywords:
Machine Learning, Malware Analysis, Cybersecurity, Model Evaluation, Performance MetricsAbstract
The burgeoning landscape of cyber threats, particularly malware, necessitates a rigorous evaluation and comparison of machine learning (ML) models used for malware analysis. This work addresses the critical need for a comprehensive assessment of these models, given their pivotal role in identifying and mitigating cyber threats. Existing methodologies in malware analysis often suffer from limitations such as suboptimal precision, accuracy, and recall, coupled with challenges in handling large-scale data, resulting in significant delays and complexity in threat detection. To address these gaps, this study undertakes an empirical review of various ML models employed in malware analysis. Our methodology involved an exhaustive examination of the current literature, focusing on the performance metrics of precision, accuracy, recall, as well as the operational aspects like complexity, delay, and scalability of each model. This review extends beyond individual metrics, offering a novel perspective by considering the interplay and combined impact of these parameters on the overall efficacy of the models. The findings of this study provide critical insights into the strengths and weaknesses of existing ML models in malware analysis. We identify key areas where improvements are needed and suggest potential pathways for enhancing the effectiveness of these models. Moreover, this work has significant implications for the field of cybersecurity, offering a nuanced understanding of how different ML models can be optimally utilized for robust malware detection and prevention, thus contributing to the advancement of safer and more secure digital environments. This comprehensive analysis serves as a valuable resource for researchers and practitioners in the field, guiding future innovations in malware analysis through machine learning
Downloads
References
S. H. Javed et al., "APT Adversarial Defence Mechanism for Industrial IoT Enabled Cyber-Physical System," in IEEE Access, vol. 11, pp. 74000-74020, 2023, doi: 10.1109/ACCESS.2023.3291599.
B. Djafer Yahia M, B. Batalo and K. Fukui, "Efficient Malware Analysis Using Subspace-Based Methods on Representative Image Patterns," in IEEE Access, vol. 11, pp. 102492-102507, 2023, doi: 10.1109/ACCESS.2023.3313409.
F. Zhong, Z. Chen, M. Xu, G. Zhang, D. Yu and X. Cheng, "Malware-on-the-Brain: Illuminating Malware Byte Codes With Images for Malware Classification," in IEEE Transactions on Computers, vol. 72, no. 2, pp. 438-451, 1 Feb. 2023, doi: 10.1109/TC.2022.3160357.
B. Jin, J. Choi, J. B. Hong and H. Kim, "On the Effectiveness of Perturbations in Generating Evasive Malware Variants," in IEEE Access, vol. 11, pp. 31062-31074, 2023, doi: 10.1109/ACCESS.2023.3262265.
S. Ali, O. Abusabha, F. Ali, M. Imran and T. Abuhmed, "Effective Multitask Deep Learning for IoT Malware Detection and Identification Using Behavioral Traffic Analysis," in IEEE Transactions on Network and Service Management, vol. 20, no. 2, pp. 1199-1209, June 2023, doi: 10.1109/TNSM.2022.3200741.
I. Gulatas, H. H. Kilinc, A. H. Zaim and M. A. Aydin, "Malware Threat on Edge/Fog Computing Environments From Internet of Things Devices Perspective," in IEEE Access, vol. 11, pp. 33584-33606, 2023, doi: 10.1109/ACCESS.2023.3262614.
Y. -H. Chen, S. -C. Lin, S. -C. Huang, C. -L. Lei and C. -Y. Huang, "Guided Malware Sample Analysis Based on Graph Neural Networks," in IEEE Transactions on Information Forensics and Security, vol. 18, pp. 4128-4143, 2023, doi: 10.1109/TIFS.2023.3283913.
R. Beg, R. K. Pateriya and D. S. Tomar, "ACMFNN: A Novel Design of an Augmented Convolutional Model for Intelligent Cross-Domain Malware Localization via Forensic Neural Networks," in IEEE Access, vol. 11, pp. 87945-87957, 2023, doi: 10.1109/ACCESS.2023.3305274.
J. Qiu et al., "Cyber Code Intelligence for Android Malware Detection," in IEEE Transactions on Cybernetics, vol. 53, no. 1, pp. 617-627, Jan. 2023, doi: 10.1109/TCYB.2022.3164625.
D. T. Uysal, P. D. Yoo and K. Taha, "Data-Driven Malware Detection for 6G Networks: A Survey From the Perspective of Continuous Learning and Explainability via Visualisation," in IEEE Open Journal of Vehicular Technology, vol. 4, pp. 61-71, 2023, doi: 10.1109/OJVT.2022.3219898.
C. Gao et al., "Obfuscation-Resilient Android Malware Analysis Based on Complementary Features," in IEEE Transactions on Information Forensics and Security, vol. 18, pp. 5056-5068, 2023, doi: 10.1109/TIFS.2023.3302509.
M. F. Abdelwahed, M. M. Kamal and S. G. Sayed, "Detecting Malware Activities With MalpMiner: A Dynamic Analysis Approach," in IEEE Access, vol. 11, pp. 84772-84784, 2023, doi: 10.1109/ACCESS.2023.3266562.
X. Deng, X. Pei, S. Tian and L. Zhang, "Edge-Based IIoT Malware Detection for Mobile Devices With Offloading," in IEEE Transactions on Industrial Informatics, vol. 19, no. 7, pp. 8093-8103, July 2023, doi: 10.1109/TII.2022.3216818.
M. M. Belal and D. M. Sundaram, "Global-Local Attention-Based Butterfly Vision Transformer for Visualization-Based Malware Classification," in IEEE Access, vol. 11, pp. 69337-69355, 2023, doi: 10.1109/ACCESS.2023.3293530.
P. Musikawan, Y. Kongsorot, I. You and C. So-In, "An Enhanced Deep Learning Neural Network for the Detection and Identification of Android Malware," in IEEE Internet of Things Journal, vol. 10, no. 10, pp. 8560-8577, 15 May15, 2023, doi: 10.1109/JIOT.2022.3194881.
C. Luo, J. Ming, J. Fu, G. Peng and Z. Li, "Reverse Engineering of Obfuscated Lua Bytecode via Interpreter Semantics Testing," in IEEE Transactions on Information Forensics and Security, vol. 18, pp. 3891-3905, 2023, doi: 10.1109/TIFS.2023.3289254.
Z. Kong, J. Xue, Y. Wang, Q. Zhang, W. Han and Y. Zhu, "MalFSM: Feature Subset Selection Method for Malware Family Classification," in Chinese Journal of Electronics, vol. 32, no. 1, pp. 26-38, January 2023, doi: 10.23919/cje.2022.00.038.
M. Kida and O. Olukoya, "Nation-State Threat Actor Attribution Using Fuzzy Hashing," in IEEE Access, vol. 11, pp. 1148-1165, 2023, doi: 10.1109/ACCESS.2022.3233403.
F. B. Khan, M. H. Durad, A. Khan, F. A. Khan, S. H. Chauhdary and M. Alqarni, "Detection of Data Scarce Malware Using One-Shot Learning With Relation Network," in IEEE Access, vol. 11, pp. 74438-74457, 2023, doi: 10.1109/ACCESS.2023.3293117.
V. Srivastava et al., "Generalized Defensive Modeling of Malware Propagation in WSNs Using Atangana–Baleanu– Caputo (ABC) Fractional Derivative," in IEEE Access, vol. 11, pp. 49042-49058, 2023, doi: 10.1109/ACCESS.2023.3276351.
R. Yumlembam, B. Issac, S. M. Jacob and L. Yang, "IoT-Based Android Malware Detection Using Graph Neural Network With Adversarial Defense," in IEEE Internet of Things Journal, vol. 10, no. 10, pp. 8432-8444, 15 May15, 2023, doi: 10.1109/JIOT.2022.3188583.
U. Ahmed, J. C. -W. Lin, G. Srivastava and A. Jolfaei, "Active Learning Based Adversary Evasion Attacks Defense for Malwares in the Internet of Things," in IEEE Systems Journal, vol. 17, no. 2, pp. 2434-2444, June 2023, doi: 10.1109/JSYST.2022.3223694.
S. Kasarapu, S. Shukla and S. M. Pudukotai Dinakarrao, "Resource- and Workload-Aware Model Parallelism-Inspired Novel Malware Detection for IoT Devices," in IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 42, no. 12, pp. 4618-4628, Dec. 2023, doi: 10.1109/TCAD.2023.3290128.
D. Uhříček, K. Hynek, T. Čejka and D. Kolář, "BOTA: Explainable IoT Malware Detection in Large Networks," in IEEE Internet of Things Journal, vol. 10, no. 10, pp. 8416-8431, 15 May15, 2023, doi: 10.1109/JIOT.2022.3228816.
A. Banik and J. P. Singh, "Android Malware Detection by Correlated Real Permission Couples Using FP Growth Algorithm and Neural Networks," in IEEE Access, vol. 11, pp. 124996-125010, 2023, doi: 10.1109/ACCESS.2023.3323845.
H. Rafiq, N. Aslam, U. Ahmed and J. C. -W. Lin, "Mitigating Malicious Adversaries Evasion Attacks in Industrial Internet of Things," in IEEE Transactions on Industrial Informatics, vol. 19, no. 1, pp. 960-968, Jan. 2023, doi: 10.1109/TII.2022.3189046.
S. Li, L. Jiang, Q. Zhang, Z. Wang, Z. Tian and M. Guizani, "A Malicious Mining Code Detection Method Based on Multi-Features Fusion," in IEEE Transactions on Network Science and Engineering, vol. 10, no. 5, pp. 2731-2739, 1 Sept.-Oct. 2023, doi: 10.1109/TNSE.2022.3155187.
C. Sun, Y. Ma, D. Zeng, G. Tan, S. Ma and Y. Wu, "μDep: Mutation-Based Dependency Generation for Precise Taint Analysis on Android Native Code," in IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 2, pp. 1461-1475, 1 March-April 2023, doi: 10.1109/TDSC.2022.3155693.
B. Wang, C. Yang and J. Ma, "IAFDroid: Demystifying Collusion Attacks in Android Ecosystem via Precise Inter-App Analysis," in IEEE Transactions on Information Forensics and Security, vol. 18, pp. 2883-2898, 2023, doi: 10.1109/TIFS.2023.3267666.
W. Ou, S. H. H. Ding, Y. Tian and L. Song, "SCS-Gan: Learning Functionality-Agnostic Stylometric Representations for Source Code Authorship Verification," in IEEE Transactions on Software Engineering, vol. 49, no. 4, pp. 1426-1442, 1 April 2023, doi: 10.1109/TSE.2022.3177228.
D. Zhan, K. Tan, L. Ye, X. Yu, H. Zhang and Z. He, "An Adversarial Robust Behavior Sequence Anomaly Detection Approach Based on Critical Behavior Unit Learning," in IEEE Transactions on Computers, vol. 72, no. 11, pp. 3286-3299, 1 Nov. 2023, doi: 10.1109/TC.2023.3292001.
M. Wazid, A. Kumar Das and S. Shetty, "BSFR-SH: Blockchain-Enabled Security Framework Against Ransomware Attacks for Smart Healthcare," in IEEE Transactions on Consumer Electronics, vol. 69, no. 1, pp. 18-28, Feb. 2023, doi: 10.1109/TCE.2022.3208795.
S. Lee, S. Lee, J. Park, K. Kim and K. Lee, "Hiding in the Crowd: Ransomware Protection by Adopting Camouflage and Hiding Strategy With the Link File," in IEEE Access, vol. 11, pp. 92693-92704, 2023, doi: 10.1109/ACCESS.2023.3309879.
G. Aldehim et al., "Gauss-Mapping Black Widow Optimization With Deep Extreme Learning Machine for Android Malware Classification Model," in IEEE Access, vol. 11, pp. 87062-87070, 2023, doi: 10.1109/ACCESS.2023.3285289.
W. Niu, Y. Wang, X. Liu, R. Yan, X. Li and X. Zhang, "GCDroid: Android Malware Detection Based on Graph Compression With Reachability Relationship Extraction for IoT Devices," in IEEE Internet of Things Journal, vol. 10, no. 13, pp. 11343-11356, 1 July1, 2023, doi: 10.1109/JIOT.2023.3241697.
M. Torres, R. Álvarez and M. Cazorla, "A Malware Detection Approach Based on Feature Engineering and Behavior Analysis," in IEEE Access, vol. 11, pp. 105355-105367, 2023, doi: 10.1109/ACCESS.2023.3319093.
J. Guo, S. Guo, S. Ma, Y. Sun and Y. Xu, "Conservative Novelty Synthesizing Network for Malware Recognition in an Open-Set Scenario," in IEEE Transactions on Neural Networks and Learning Systems, vol. 34, no. 2, pp. 662-676, Feb. 2023, doi: 10.1109/TNNLS.2021.3099122.
Y. He, Y. Liu, L. Wu, Z. Yang, K. Ren and Z. Qin, "MsDroid: Identifying Malicious Snippets for Android Malware Detection," in IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 3, pp. 2025-2039, 1 May-June 2023, doi: 10.1109/TDSC.2022.3168285.
O. E. Kural, E. Kiliç and C. Aksaç, "Apk2Audio4AndMal: Audio Based Malware Family Detection Framework," in IEEE Access, vol. 11, pp. 27527-27535, 2023, doi: 10.1109/ACCESS.2023.3258377.
V. Ravi, T. D. Pham and M. Alazab, "Attention-Based Multidimensional Deep Learning Approach for Cross-Architecture IoMT Malware Detection and Classification in Healthcare Cyber-Physical Systems," in IEEE Transactions on Computational Social Systems, vol. 10, no. 4, pp. 1597-1606, Aug. 2023, doi: 10.1109/TCSS.2022.3198123.
H. Alamro, W. Mtouaa, S. Aljameel, A. S. Salama, M. A. Hamza and A. Y. Othman, "Automated Android Malware Detection Using Optimal Ensemble Learning Approach for Cybersecurity," in IEEE Access, vol. 11, pp. 72509-72517, 2023, doi: 10.1109/ACCESS.2023.3294263.
T. He, C. Han, R. Isawa, T. Takahashi, S. Kijima and J. Takeuchi, "Scalable and Fast Algorithm for Constructing Phylogenetic Trees With Application to IoT Malware Clustering," in IEEE Access, vol. 11, pp. 8240-8253, 2023, doi: 10.1109/ACCESS.2023.3238711.
S. Li, Y. Li, X. Wu, S. A. Otaibi and Z. Tian, "Imbalanced Malware Family Classification Using Multimodal Fusion and Weight Self-Learning," in IEEE Transactions on Intelligent Transportation Systems, vol. 24, no. 7, pp. 7642-7652, July 2023, doi: 10.1109/TITS.2022.3208891.
H. Lee, S. Kim, D. Baek, D. Kim and D. Hwang, "Robust IoT Malware Detection and Classification Using Opcode Category Features on Machine Learning," in IEEE Access, vol. 11, pp. 18855-18867, 2023, doi: 10.1109/ACCESS.2023.3247344.
A. Coscia, V. Dentamaro, S. Galantucci, A. Maci and G. Pirlo, "YAMME: a YAra-byte-signatures Metamorphic Mutation Engine," in IEEE Transactions on Information Forensics and Security, vol. 18, pp. 4530-4545, 2023, doi: 10.1109/TIFS.2023.3294059.
L. d. Costa and V. Moia, "A Lightweight and Multi-Stage Approach for Android Malware Detection Using Non-Invasive Machine Learning Techniques," in IEEE Access, vol. 11, pp. 73127-73144, 2023, doi: 10.1109/ACCESS.2023.3296606.
M. Venkatasubramanian, A. H. Lashkari and S. Hakak, "IoT Malware Analysis Using Federated Learning: A Comprehensive Survey," in IEEE Access, vol. 11, pp. 5004-5018, 2023, doi: 10.1109/ACCESS.2023.3235389.
C. Zhang, S. Yin, H. Li, M. Cai and W. Yuan, "Detecting Android Malware With Pre-Existing Image Classification Neural Networks," in IEEE Signal Processing Letters, vol. 30, pp. 858-862, 2023, doi: 10.1109/LSP.2023.3294695.
X. Zhang, J. Wang, J. Xu and C. Gu, "Detection of Android Malware Based on Deep Forest and Feature Enhancement," in IEEE Access, vol. 11, pp. 29344-29359, 2023, doi: 10.1109/ACCESS.2023.3260977.
Y. Zhang, G. Gui and S. Mao, "A Lightweight Malware Traffic Classification Method Based on a Broad Learning Architecture," in IEEE Internet of Things Journal, vol. 10, no. 23, pp. 21131-21132, 1 Dec.1, 2023, doi: 10.1109/JIOT.2023.3297210.
J. Chen, S. Sun, C. Xia, D. Shi and G. Chen, "Modeling and Analyzing Malware Propagation Over Wireless Networks Based on Hypergraphs," in IEEE Transactions on Network Science and Engineering, vol. 10, no. 6, pp. 3767-3778, Nov.-Dec. 2023, doi: 10.1109/TNSE.2023.3273184.
Downloads
Published
How to Cite
Issue
Section
License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
All papers should be submitted electronically. All submitted manuscripts must be original work that is not under submission at another journal or under consideration for publication in another form, such as a monograph or chapter of a book. Authors of submitted papers are obligated not to submit their paper for publication elsewhere until an editorial decision is rendered on their submission. Further, authors of accepted papers are prohibited from publishing the results in other publications that appear before the paper is published in the Journal unless they receive approval for doing so from the Editor-In-Chief.
IJISAE open access articles are licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. This license lets the audience to give appropriate credit, provide a link to the license, and indicate if changes were made and if they remix, transform, or build upon the material, they must distribute contributions under the same license as the original.
