An Improved Pre-Exploitation Detection Model for Android Malware Attacks
Received: 27 April 2024 | Revised: 17 June 2024 | Accepted: 25 June 2024 | Online: 11 August 2024
Corresponding author: Hamad Saleh Al Besher
Abstract
This paper presents an innovative approach to the early detection of Android malware, focusing on a dynamic pre-exploitation phase identification system. Traditional methods often rely on static thresholding to delineate the pre-exploitation phase of malware attacks, which can be insufficient due to the diverse behaviors exhibited by various malware families. This study introduces the Dynamic Pre-exploitation Boundary Definition and Feature Extraction (DPED-FE) system to address these limitations, which utilizes entropy for change detection, thus enabling more accurate and timely identification of potential threats before they reach the exploitation phase. A comprehensive analysis of the system's methodology is provided, including the use of vector space models with Kullback-Leibler divergence for dynamic boundary detection and advanced feature extraction techniques such as Weighted Term Frequency-Inverse Document Frequency (WF-IDF) to enhance its predictive capabilities. The experimental results demonstrate the superior performance of DPED-FE compared to traditional methods, highlighting its effectiveness in real-world scenarios.
Keywords:
malware, Android, TF-IDF, pre-exploitation, machine learningDownloads
References
N. Ye, Y. Zhang, and C. M. Borror, "Robustness of the Markov-chain model for cyber-attack detection," IEEE Transactions on Reliability, vol. 53, no. 1, pp. 116–123, Mar. 2004.
I. Yaqoob et al., "The rise of ransomware and emerging security challenges in the Internet of Things," Computer Networks, vol. 129, pp. 444–458, Dec. 2017.
J. Chen, C. Wang, Z. Zhao, K. Chen, R. Du, and G. J. Ahn, "Uncovering the Face of Android Ransomware: Characterization and Real-Time Detection," IEEE Transactions on Information Forensics and Security, vol. 13, no. 5, pp. 1286–1300, Feb. 2018.
A. Azmoodeh, A. Dehghantanha, M. Conti, and K. K. R. Choo, "Detecting crypto-ransomware in IoT networks based on energy consumption footprint," Journal of Ambient Intelligence and Humanized Computing, vol. 9, no. 4, pp. 1141–1152, Aug. 2018.
S. Demesie Yalew, G. Q. Maguire, S. Haridi, and M. Correia, "Hail to the Thief: Protecting data from mobile ransomware with ransomsafedroid," in 2017 IEEE 16th International Symposium on Network Computing and Applications (NCA), Cambridge, MA, USA, Oct. 2017, pp. 1–8.
J. A. Gómez-Hernández, L. Álvarez-González, and P. García-Teodoro, "R-Locker: Thwarting ransomware action through a honeyfile-based approach," Computers & Security, vol. 73, pp. 389–398, Mar. 2018.
M. A. Azad, F. Riaz, A. Aftab, S. K. J. Rizvi, J. Arshad, and H. F. Atlam, "DEEPSEL: A novel feature selection for early identification of malware in mobile applications," Future Generation Computer Systems, vol. 129, pp. 54–63, Apr. 2022.
N. Caporusso, S. Chea, and R. Abukhaled, "A Game-Theoretical Model of Ransomware," in Advances in Human Factors in Cybersecurity, Orlando, FL, USA, 2019, pp. 69–78.
S. Homayoun, A. Dehghantanha, M. Ahmadzadeh, S. Hashemi, and R. Khayami, "Know Abnormal, Find Evil: Frequent Pattern Mining for Ransomware Threat Hunting and Intelligence," IEEE Transactions on Emerging Topics in Computing, vol. 8, no. 2, pp. 341–351, Apr. 2020.
G. Cusack, O. Michel, and E. Keller, "Machine Learning-Based Detection of Ransomware Using SDN," in Proceedings of the 2018 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization, Temple, AZ, USA, Nov. 2018.
D. Y. Kao and S.-C. Hsiao, "The dynamic analysis of WannaCry ransomware," in 2018 20th International Conference on Advanced Communication Technology (ICACT), Chuncheon, Korea (South), Feb. 2018, pp. 159–166.
N. Hampton, Z. Baig, and S. Zeadally, "Ransomware behavioural analysis on windows platforms," Journal of Information Security and Applications, vol. 40, pp. 44–51, Jun. 2018.
A. Cohen and N. Nissim, "Trusted detection of ransomware in a private cloud using machine learning methods leveraging meta-features from volatile memory," Expert Systems with Applications, vol. 102, pp. 158–178, Jul. 2018.
"Development of new Android malware worldwide from June 2016 to March 2020," Statista. https://www.statista.com/statistics/680705/
global-android-malware-volume/.
T. Shishkova, "IT threat evolution in Q1 2022. Mobile statistics," May 27, 2022. https://securelist.com/it-threat-evolution-in-q1-2022-mobile-statistics/106589/.
B. A. S. Al-Rimy et al., "A Pseudo Feedback-Based Annotated TF-IDF Technique for Dynamic Crypto-Ransomware Pre-Encryption Boundary Delineation and Features Extraction," IEEE Access, vol. 8, pp. 140586–140598, 2020.
D. Sgandurra, L. Muñoz-González, R. Mohsen, and E. C. Lupu, "Automated Dynamic Analysis of Ransomware: Benefits, Limitations and use for Detection." arXiv, Sep. 10, 2016.
S. Homayoun et al., "Deep dive into ransomware threat hunting and intelligence at fog layer," Future Generation Computer Systems, vol. 90, no. Jan 19, Jul. 2018.
X. Zhang et al., "An Early Detection of Android Malware Using System Calls based Machine Learning Model," in Proceedings of the 17th International Conference on Availability, Reliability and Security, Vienna, Austria, Aug. 2022.
M. Alam, S. Sinha, S. Bhattacharya, S. Dutta, D. Mukhopadhyay, and A. Chattopadhyay, "RAPPER: Ransomware Prevention via Performance Counters." arXiv, Apr. 03, 2020.
M. Rhode, P. Burnap, and K. Jones, "Early-stage malware prediction using recurrent neural networks," Computers & Security, vol. 77, pp. 578–594, Aug. 2018.
S. Das, Y. Liu, W. Zhang, and M. Chandramohan, "Semantics-Based Online Malware Detection: Towards Efficient Real-Time Protection Against Malware," IEEE Transactions on Information Forensics and Security, vol. 11, no. 2, pp. 289–302, Oct. 2016.
N. Nissim, Y. Lapidot, A. Cohen, and Y. Elovici, "Trusted system-calls analysis methodology aimed at detection of compromised virtual machines using sequential mining," Knowledge-Based Systems, vol. 153, pp. 147–175, Aug. 2018.
D. Morato, E. Berrueta, E. Magaña, and M. Izal, "Ransomware early detection by the analysis of file sharing traffic," Journal of Network and Computer Applications, vol. 124, pp. 14–32, Dec. 2018, https://doi.org/10.1016/j.jnca.2018.09.013.
B. A. S. Al-rimy, M. A. Maarof, and S. Z. M. Shaid, "Crypto-ransomware early detection model using novel incremental bagging with enhanced semi-random subspace selection," Future Generation Computer Systems, vol. 101, pp. 476–491, Dec. 2019.
B. A. S. Al-rimy et al., "Redundancy Coefficient Gradual Up-weighting-based Mutual Information Feature Selection technique for Crypto-ransomware early detection," Future Generation Computer Systems, vol. 115, pp. 641–658, Feb. 2021.
A. Kharaz, S. Arshad, C. Mulliner, W. Robertson, and E. Kirda, "UNVEIL: A Large-Scale, Automated Approach to Detecting Ransomware," presented at the 25th USENIX Security Symposium (USENIX Security 16), Austin, TX, USA, 2016, pp. 757–772.
W. Z. A. Zakaria, N. M. K. M. Alta, M. F. Abdollah, O. Abdollah, and S. M. M. Yassin, "Early Detection of Windows Cryptographic Ransomware Based on Pre-Attack API Calls Features and Machine Learning," Journal of Advanced Research in Applied Sciences and Engineering Technology, vol. 39, no. 2, pp. 110–131, Feb. 2024.
A. Alqahtani and F. T. Sheldon, "eMIFS: A Normalized Hyperbolic Ransomware Deterrence Model Yielding Greater Accuracy and Overall Performance," Sensors, vol. 24, no. 6, Jan. 2024, Art. no. 1728.
S. H. Kok, A. Abdullah, N. Z. Jhanjhi, and M. Supramaniam, "Prevention of Crypto-Ransomware Using a Pre-Encryption Detection Algorithm," Computers, vol. 8, no. 4, Dec. 2019, Art. no. 79.
M. A. Aftab and D. Q. Shafi, "Advanced Ransomware Detection: Unveiling Anti-Analysis Tactics through Enhanced Temporal Data Correlation." Research Square, Mar. 07, 2024.
N. Niture, "Machine Learning and Cryptographic Algorithms -- Analysis and Design in Ransomware and Vulnerabilities Detection." TechRxiv, Oct. 29, 2020.
C. C. Moreira, J. Claudomiro de Souza de Sales, and D. C. Moreira, "Understanding Ransomware Actions Through Behavioral Feature Analysis," Journal of Communication and Information Systems, vol. 37, no. 1, pp. 61–76, Mar. 2022.
K. Lee, S. Y. Lee, and K. Yim, "Machine Learning Based File Entropy Analysis for Ransomware Detection in Backup Systems," IEEE Access, vol. 7, pp. 110205–110215, 2019.
N. Suditu and F. Fleuret, "Iterative relevance feedback with adaptive exploration/exploitation trade-off," in Proceedings of the 21st ACM international conference on Information and knowledge management, Maui, HI, USA, Jul. 2012, pp. 1323–1331.
H. Zhang, X. Xiao, F. Mercaldo, S. Ni, F. Martinelli, and A. K. Sangaiah, "Classification of ransomware families with machine learning based on N-gram of opcodes," Future Generation Computer Systems, vol. 90, pp. 211–221, Jan. 2019.
Downloads
How to Cite
License
Copyright (c) 2024 Hamad Saleh Al Besher, Mohd Fo’ad Bin Rohani, Bander Ali Saleh Al-rimy
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain the copyright and grant the journal the right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) after its publication in ETASR with an acknowledgement of its initial publication in this journal.