نوع مقاله : مقاله پژوهشی
نویسندگان
1 دانشجوی کارشناسی ارشد، دانشگاه جامع امام حسین (ع)، تهران، ایران
2 استادیار، دانشگاه جامع امام حسین (ع)، تهران، ایران
3 استادیار، دانشگاه صنعتی مالک اشتر، تهران، ایران
چکیده
کلیدواژهها
عنوان مقاله [English]
نویسندگان [English]
The growing number of malware is one of the major threats in the field of cyber and malware detection has always been associated with challenges. Windows-based malicious executable files perform malicious activities at the target operating system level or any other application by manipulating features in their header and obscuring their behavior. Detecting suspicious specimens from a large volume of input samples as well as discovering new and unknown malware is one of the researchers' favorite topics. In this study, a combined method has been proposed to determine the level of maliciousness of suspicious executable files. Kashef's proposed method consists of two static modules for extracting executable file header properties, and two behavioral modules for extracting signature-generating properties and a thoughtful behavioral model based on machine learning methods. The purpose of this study is to identify suspicious Windows executable files from a large volume of files and determine their maliciousness level. This method detects malware based on the maliciousness probability assigned to each file. Experiments have been done to determine the malignancy percentage of six malware by four types of detectors. The results show the malignancy percentage for the PE header detector module, to be in the range of 62.7 to 70% and for the Yara-based detector module, to be in the range of 70.8 to 78.2%, whilst for the behavioral signature-based detector module, the malignancy percentage is 98% and for the ML-based detector module using the random forest learning algorithm it is equal to 99%. The experimental results also show that Kashef detected 94% of protected malware with a 2% improvement compared to the achievements of 10 similar rival products, and it detected 98% of unprotected malware, demonstrating a 5% improvement compared to counterpart results of 10 similar products.
کلیدواژهها [English]
)
