A multi-dimensional machine learning approach to predict advanced malware

• Published in: Computer networks (Amsterdam, Netherlands : 1999) Netherlands : 1999), 2019-09, Vol.160, p.118-129
• Main Authors: Bahtiyar, Şerif, Yaman, Mehmet Barış, Altıniğne, Can Yılmaz
• Format: Article
• Language: English
• Subjects: Advanced malware; API Call; Classification; Machine learning; Prediction
• ISSN: 1389-1286; 1872-7069
• DOI: 10.1016/j.comnet.2019.06.015

The growth of cyber-attacks that are carried out with malware have become more sophisticated on almost all networks. Furthermore, attacks with advanced malware have the greatest complexity which makes them very hard to detect. Advanced malware is able to obfuscate much of their traces through many mechanisms, such as metamorphic engines. Therefore, predictions and detections of such malware have become significant challenge for malware analyses mechanisms. In this paper, we propose a multi-dimensional machine learning approach to predict Stuxnet like malware from a dataset that consists of malware samples by using five distinguishing features of advanced malware. We define the features by analyzing advanced malware samples in the wild. Our approach uses regression models to predict advanced malware. We create a malware dataset from existing datasets that contain real samples for experimental purposes. Analyses results show that there are high correlations among some features of advanced malware. These provide better predictions scores, such as R2=0.8203 score for Stuxnet closeness feature. Experimental analyses show that our approach is able to predict Stuxnet like advanced malware if prediction features defined.