Predictive Malware Defense using Machine Learning

Project Title

Predictive Malware Defense using Machine Learning

Project Area of Specialization Cyber SecurityProject Summary

Malware based attacks are a serious threat concerned to cyber security. It is the most costly attack, the companies having unprotected data and poor cyber security practices had suffered extreme loss. Signature-based detection techniques failed to detect novel malware variants, thus making the antivirus programs a failure.

Malware protection of computer systems is one of the most important cybersecurity tasks for single users and businesses, since even a single attack can result in compromised data and sufficient losses. Massive losses and frequent attacks dictate the need for accurate and timely detection methods. Current static and dynamic methods do not provide efficient detection, especially when dealing with zero-day attacks. For this reason, machine learning-based techniques can be used. The goal of this project to develop a machine learning based Malware classifier and a Predictive model that predict patterns of future malwares.

Project Objectives

• Develop a malicious code (or malware) free environment.
• Produce behavioral reports of analyzed malicious samples.
• Implement malware family classifier.
• Developing predictive model to predict new patterns of future malware.

Project Implementation Method

The methodology is classified into three major phases:

Phase 1:   Malware Analysis

First task is to extract behavior of malware samples, which will be used as an input to the machine learning algorithms using advanced dynamic and static analysis.

Phase 2:  Machine Learning Based Malware Analysis and Identification

Once behavior reports of each malware sample are generated, next task is to extract malware features and create a feature vector. Further these feature vectors are used to classify malware into their families. This phase includes following tasks:

1. Malware Reverse Engineering

In this stage, our sole purpose was to understand how malicious codes work. Malicious binaries were disassembled and debugged for detail analysis.

      2.  Data Acquisition/Malware Collection

For this project, a total of 2,376binary files were collected.) To be able to operate with a diverse dataset, seven malware families are used, resulting in 996 malicious files. These files are collected from VirusShare,

     3.  Automated Malware Analysis using Cuckoo Sandbox

Cuckoo Sandbox is the open-source malware analysis tool that allows getting the detailed behavioral report of any file or URL in a matter of seconds.

    4.  Feature Extraction

To apply machine learning algorithms to the problem, we need to figure out what kind of data should be extracted and how it should be presented.

In our project, we have worked on behavior-based features rather than static features because static approaches fail to identify polymorphic malwares.

     5.  Malware Family Classification

Next step after feature set representation is to create a classification model. In this stage, we will develop various classifiers and select the one with highest accuracy and low false positives/negatives.

PHASE 3:  Predictive Model

This phase has the immense role in predicting the new families of the malware. Both the past and future history of families is maintained using Linear Graphs. Since we are predicting complex outputs with unknown relationships between features in the output. Neural Networks can be used to discover these hidden relationships and predict patterns.

Benefits of the Project

As the proposed system is a defense framework, companies that provide security solutions or those concerned with data privacy are beneficiaries of it.

Technical Details of Final Deliverable

Final deliverable of this project is:

• Framework based on Django, it is a web interface where user can submit any file and system will analyze the file, generate report and classify it into malicious or benign file. 
• Cuckoo sandbox integrated with web framework that analyzes files on submission and genearates reports.
• Classification algorithms used are: Logistic Regression, KNN, SVM and Random Forest.

Final Deliverable of the Project Software SystemType of Industry IT Technologies Artificial Intelligence(AI), OthersSustainable Development Goals Industry, Innovation and InfrastructureRequired Resources

Item Name	Type	No. of Units	Per Unit Cost (in Rs)	Total (in Rs)
			Total in (Rs)	80000
Sandbox server machines	Equipment	1	70000	70000
USB/convertors/stationary	Miscellaneous	1	10000	10000