An Improved Pre-Exploitation Detection Model for Android Malware Attacks

Authors

  • Hamad Saleh Al Besher Applied College, Najran University, Saudi Arabia | Faculty of Computing, Universiti Teknologi Malaysia, Malaysia
  • Mohd Fo’ad Bin Rohani Faculty of Computing, Universiti Teknologi Malaysia, Malaysia
  • Bander Ali Saleh Al-rimy School of Computing, University of Portsmouth, Buckingham Building, Lion Terrace, Portsmouth PO1 3HE, United Kingdom
Volume: 14 | Issue: 5 | Pages: 16252-16259 | October 2024 | https://doi.org/10.48084/etasr.7661

Abstract

This paper presents an innovative approach to the early detection of Android malware, focusing on a dynamic pre-exploitation phase identification system. Traditional methods often rely on static thresholding to delineate the pre-exploitation phase of malware attacks, which can be insufficient due to the diverse behaviors exhibited by various malware families. This study introduces the Dynamic Pre-exploitation Boundary Definition and Feature Extraction (DPED-FE) system to address these limitations, which utilizes entropy for change detection, thus enabling more accurate and timely identification of potential threats before they reach the exploitation phase. A comprehensive analysis of the system's methodology is provided, including the use of vector space models with Kullback-Leibler divergence for dynamic boundary detection and advanced feature extraction techniques such as Weighted Term Frequency-Inverse Document Frequency (WF-IDF) to enhance its predictive capabilities. The experimental results demonstrate the superior performance of DPED-FE compared to traditional methods, highlighting its effectiveness in real-world scenarios.

Keywords:

malware, Android, TF-IDF, pre-exploitation, machine learning

Downloads

Download data is not yet available.

References

N. Ye, Y. Zhang, and C. M. Borror, "Robustness of the Markov-chain model for cyber-attack detection," IEEE Transactions on Reliability, vol. 53, no. 1, pp. 116–123, Mar. 2004.

I. Yaqoob et al., "The rise of ransomware and emerging security challenges in the Internet of Things," Computer Networks, vol. 129, pp. 444–458, Dec. 2017.

J. Chen, C. Wang, Z. Zhao, K. Chen, R. Du, and G. J. Ahn, "Uncovering the Face of Android Ransomware: Characterization and Real-Time Detection," IEEE Transactions on Information Forensics and Security, vol. 13, no. 5, pp. 1286–1300, Feb. 2018.

A. Azmoodeh, A. Dehghantanha, M. Conti, and K. K. R. Choo, "Detecting crypto-ransomware in IoT networks based on energy consumption footprint," Journal of Ambient Intelligence and Humanized Computing, vol. 9, no. 4, pp. 1141–1152, Aug. 2018.

S. Demesie Yalew, G. Q. Maguire, S. Haridi, and M. Correia, "Hail to the Thief: Protecting data from mobile ransomware with ransomsafedroid," in 2017 IEEE 16th International Symposium on Network Computing and Applications (NCA), Cambridge, MA, USA, Oct. 2017, pp. 1–8.

J. A. Gómez-Hernández, L. Álvarez-González, and P. García-Teodoro, "R-Locker: Thwarting ransomware action through a honeyfile-based approach," Computers & Security, vol. 73, pp. 389–398, Mar. 2018.

M. A. Azad, F. Riaz, A. Aftab, S. K. J. Rizvi, J. Arshad, and H. F. Atlam, "DEEPSEL: A novel feature selection for early identification of malware in mobile applications," Future Generation Computer Systems, vol. 129, pp. 54–63, Apr. 2022.

N. Caporusso, S. Chea, and R. Abukhaled, "A Game-Theoretical Model of Ransomware," in Advances in Human Factors in Cybersecurity, Orlando, FL, USA, 2019, pp. 69–78.

S. Homayoun, A. Dehghantanha, M. Ahmadzadeh, S. Hashemi, and R. Khayami, "Know Abnormal, Find Evil: Frequent Pattern Mining for Ransomware Threat Hunting and Intelligence," IEEE Transactions on Emerging Topics in Computing, vol. 8, no. 2, pp. 341–351, Apr. 2020.

G. Cusack, O. Michel, and E. Keller, "Machine Learning-Based Detection of Ransomware Using SDN," in Proceedings of the 2018 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization, Temple, AZ, USA, Nov. 2018.

D. Y. Kao and S.-C. Hsiao, "The dynamic analysis of WannaCry ransomware," in 2018 20th International Conference on Advanced Communication Technology (ICACT), Chuncheon, Korea (South), Feb. 2018, pp. 159–166.

N. Hampton, Z. Baig, and S. Zeadally, "Ransomware behavioural analysis on windows platforms," Journal of Information Security and Applications, vol. 40, pp. 44–51, Jun. 2018.

A. Cohen and N. Nissim, "Trusted detection of ransomware in a private cloud using machine learning methods leveraging meta-features from volatile memory," Expert Systems with Applications, vol. 102, pp. 158–178, Jul. 2018.

"Development of new Android malware worldwide from June 2016 to March 2020," Statista. https://www.statista.com/statistics/680705/

global-android-malware-volume/.

T. Shishkova, "IT threat evolution in Q1 2022. Mobile statistics," May 27, 2022. https://securelist.com/it-threat-evolution-in-q1-2022-mobile-statistics/106589/.

B. A. S. Al-Rimy et al., "A Pseudo Feedback-Based Annotated TF-IDF Technique for Dynamic Crypto-Ransomware Pre-Encryption Boundary Delineation and Features Extraction," IEEE Access, vol. 8, pp. 140586–140598, 2020.

D. Sgandurra, L. Muñoz-González, R. Mohsen, and E. C. Lupu, "Automated Dynamic Analysis of Ransomware: Benefits, Limitations and use for Detection." arXiv, Sep. 10, 2016.

S. Homayoun et al., "Deep dive into ransomware threat hunting and intelligence at fog layer," Future Generation Computer Systems, vol. 90, no. Jan 19, Jul. 2018.

X. Zhang et al., "An Early Detection of Android Malware Using System Calls based Machine Learning Model," in Proceedings of the 17th International Conference on Availability, Reliability and Security, Vienna, Austria, Aug. 2022.

M. Alam, S. Sinha, S. Bhattacharya, S. Dutta, D. Mukhopadhyay, and A. Chattopadhyay, "RAPPER: Ransomware Prevention via Performance Counters." arXiv, Apr. 03, 2020.

M. Rhode, P. Burnap, and K. Jones, "Early-stage malware prediction using recurrent neural networks," Computers & Security, vol. 77, pp. 578–594, Aug. 2018.

S. Das, Y. Liu, W. Zhang, and M. Chandramohan, "Semantics-Based Online Malware Detection: Towards Efficient Real-Time Protection Against Malware," IEEE Transactions on Information Forensics and Security, vol. 11, no. 2, pp. 289–302, Oct. 2016.

N. Nissim, Y. Lapidot, A. Cohen, and Y. Elovici, "Trusted system-calls analysis methodology aimed at detection of compromised virtual machines using sequential mining," Knowledge-Based Systems, vol. 153, pp. 147–175, Aug. 2018.

D. Morato, E. Berrueta, E. Magaña, and M. Izal, "Ransomware early detection by the analysis of file sharing traffic," Journal of Network and Computer Applications, vol. 124, pp. 14–32, Dec. 2018, https://doi.org/10.1016/j.jnca.2018.09.013.

B. A. S. Al-rimy, M. A. Maarof, and S. Z. M. Shaid, "Crypto-ransomware early detection model using novel incremental bagging with enhanced semi-random subspace selection," Future Generation Computer Systems, vol. 101, pp. 476–491, Dec. 2019.

B. A. S. Al-rimy et al., "Redundancy Coefficient Gradual Up-weighting-based Mutual Information Feature Selection technique for Crypto-ransomware early detection," Future Generation Computer Systems, vol. 115, pp. 641–658, Feb. 2021.

A. Kharaz, S. Arshad, C. Mulliner, W. Robertson, and E. Kirda, "UNVEIL: A Large-Scale, Automated Approach to Detecting Ransomware," presented at the 25th USENIX Security Symposium (USENIX Security 16), Austin, TX, USA, 2016, pp. 757–772.

W. Z. A. Zakaria, N. M. K. M. Alta, M. F. Abdollah, O. Abdollah, and S. M. M. Yassin, "Early Detection of Windows Cryptographic Ransomware Based on Pre-Attack API Calls Features and Machine Learning," Journal of Advanced Research in Applied Sciences and Engineering Technology, vol. 39, no. 2, pp. 110–131, Feb. 2024.

A. Alqahtani and F. T. Sheldon, "eMIFS: A Normalized Hyperbolic Ransomware Deterrence Model Yielding Greater Accuracy and Overall Performance," Sensors, vol. 24, no. 6, Jan. 2024, Art. no. 1728.

S. H. Kok, A. Abdullah, N. Z. Jhanjhi, and M. Supramaniam, "Prevention of Crypto-Ransomware Using a Pre-Encryption Detection Algorithm," Computers, vol. 8, no. 4, Dec. 2019, Art. no. 79.

M. A. Aftab and D. Q. Shafi, "Advanced Ransomware Detection: Unveiling Anti-Analysis Tactics through Enhanced Temporal Data Correlation." Research Square, Mar. 07, 2024.

N. Niture, "Machine Learning and Cryptographic Algorithms -- Analysis and Design in Ransomware and Vulnerabilities Detection." TechRxiv, Oct. 29, 2020.

C. C. Moreira, J. Claudomiro de Souza de Sales, and D. C. Moreira, "Understanding Ransomware Actions Through Behavioral Feature Analysis," Journal of Communication and Information Systems, vol. 37, no. 1, pp. 61–76, Mar. 2022.

K. Lee, S. Y. Lee, and K. Yim, "Machine Learning Based File Entropy Analysis for Ransomware Detection in Backup Systems," IEEE Access, vol. 7, pp. 110205–110215, 2019.

N. Suditu and F. Fleuret, "Iterative relevance feedback with adaptive exploration/exploitation trade-off," in Proceedings of the 21st ACM international conference on Information and knowledge management, Maui, HI, USA, Jul. 2012, pp. 1323–1331.

H. Zhang, X. Xiao, F. Mercaldo, S. Ni, F. Martinelli, and A. K. Sangaiah, "Classification of ransomware families with machine learning based on N-gram of opcodes," Future Generation Computer Systems, vol. 90, pp. 211–221, Jan. 2019.

Downloads

How to Cite

[1]
Al Besher, H.S., Bin Rohani, M.F. and Saleh Al-rimy, B.A. 2024. An Improved Pre-Exploitation Detection Model for Android Malware Attacks. Engineering, Technology & Applied Science Research. 14, 5 (Oct. 2024), 16252–16259. DOI:https://doi.org/10.48084/etasr.7661.

Metrics

Abstract Views: 65
PDF Downloads: 108

Metrics Information