XMal: A Lightweight Memory-Based Explainable Obfuscated-Malware Detector

An average of 560,000 new malware instances are being detected every day. Malware detection is becoming one of the biggest challenges in the field of computer security. The use of code obfuscation techniques by malicious actors is gaining popularity, further complicating the process of detection. In...

Full description

Saved in:
Bibliographic Details
Published in:Computers & security 2023-10, Vol.133, p.103409, Article 103409
Main Authors: Alani, Mohammed M., Mashatan, Atefeh, Miri, Ali
Format: Article
Language:English
Subjects:
explainable machine learning
machine learning
malware
malware detection
obfuscated malware
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:An average of 560,000 new malware instances are being detected every day. Malware detection is becoming one of the biggest challenges in the field of computer security. The use of code obfuscation techniques by malicious actors is gaining popularity, further complicating the process of detection. In this paper, we introduce a lightweight obfuscated-malware detector based on machine learning that is also explainable. The proposed method, based on extreme gradient boost, employs only five features extracted from memory dumps, achieving a detection accuracy of over 99%. These five features were selected using recursive feature elimination, based on feature importance. Through testing, we demonstrated that the system was capable of detecting malware instances in just 0.413 μs. The model was explained using Shapley additive explanations.
ISSN:0167-4048
1872-6208
DOI:10.1016/j.cose.2023.103409