A Robust Method for Malware Analysis Using Stacking Classifiers and Dendrogram Visualization

doi:10.21203/rs.3.rs-3969781/v1

Download PDF

Research Article

A Robust Method for Malware Analysis Using Stacking Classifiers and Dendrogram Visualization

https://doi.org/10.21203/rs.3.rs-3969781/v1

This work is licensed under a CC BY 4.0 License

Version 1

posted

You are reading this latest preprint version

Malware analysis is a vital and challenging task in the ever-changing cyber threat landscape. Traditional signature-based methods cannot keep up with the fast-paced evolution of malware variants. This underscores the need for developing a more effective malware classification tool helping in exploring new research directions with solutions. In this research work firstly, we present a comprehensive assessment on malware classification using dendrogram clustering techniques. This work proposes, a robust approach to malware analysis by constructing dendrogram that groups malware samples which works based on their ancestral relationships. Semantic analysis of the code also provides deeper insights into the malware’s behavior and functionality, enabling more precise identification. These methods help to detect new variants as well as enhance the recognition of existing malware families. Our proposed model results shows that, the robustness in accuracy and False Positive Rate when compared with other existing models.

Malware classification

Semantic Analysis

Autoencoder Decoder

Dendro-gram.

In the realm of cybersecurity, the task of analyzing malware has emerged as a critical and complex task. Malware or malicious software, poses a substantial threat to the data security of digital systems worldwide. As Internet is expanding day by day, protecting data from unauthorized access is difficult. Many security issues like protecting personal information and also from unauthorized access to the devices [1]. Traditional methods of malware detection, primarily based on signature detection, that are quick at identifying known as malware, but they fall short in the face of the swift and continuous emergence of new malware variants [2]. Malware samples are used by attackers or hackers by changing the malware signatures and can making them bypass most anti-virus software’s [3]. These traditional methods involve identifying malware based on known patterns or signatures. However, as new malware variants are developed, these signatures become outdated, rendering the traditional methods ineffective. This underscores the urgent need for more innovative and effective approaches for malware classification. There is a need for machine learning techniques to detect and classify malwares. As, they can be used effectively to understand malware dynamics with the help of wide range of algorithms [4].

Addressing the need, this study to introduces a groundbreaking approach to malware analysis. This approach integrates two powerful techniques: stacking classifiers for classification and dendrogram for visualization.

Stacking classifiers, also known as stacked generalization, is a method used in machine learning. It involves training the multiple models of different types and then combining their predictions. This ensemble learning method leverages the strengths of various models, thereby improving the overall performance and robustness of the system. In the context of malware analysis, Ensemble methods can enhance the accuracy and reliability of malware detection [5]. On the other hand, dendrogram visualization is a technique used in hierarchical clustering which groups similar families [6]. It presents the clusters formed in a tree-like structure, providing a clear and organized representation of the different malware families with their variants. This visualization aids in understanding the relationships and similarities between different malware samples, thereby enhancing the process of malware classification.

By combining these two powerful techniques, this novel method aims to provide a more precise and comprehensive analysis of malware. It not only enhances the detection of existing malware families but also aids in identifying new variants. This dynamic approach to the malware analysis represents a substantial improvement in the field of cybersecurity. The integration of stacking classifiers and dendrogram visualization in malware analysis offers several advantages. The stacking classifiers are allowing us for the combination of different models, each with its strengths, leading to improved performance. The dendrogram visualization, on the other hand, provides a clear and organized representation of the malware samples, making it easier to understand their relationships and classify them accurately. Moreover, this robust method is not just about detecting and classifying malware. It also provides deeper insights into the behavior and functionality of malware and their families. By analyzing the code semantics, thereby, understanding what the code does and how it does, we can identify the malware more precisely. This not only enhances the recognition of existing malware families but also aids in the detection of new variants.

We conclude this paper to present a promising approach to malware analysis. Table 1 shows the comparative study of proposed model and other traditional methods. It underscores the importance of continuous innovation in the field of cybersecurity and sets a new direction for future research developments in malware analysis. The proposed method, with its high accuracy and low false positive rate, has the potential to significantly enhance our ability to secure digital systems against cyber threats.

Table 1

Comparison of Traditional Methods and Stacking Classifiers & Dendrogram Analysis.
Comparison Parameter	Traditional Methods	Stacking Classifiers & Dendrogram Analysis
Accuracy	Moderate, due to obfuscation and new variants	High, due to combination of multiple models and evolutionary analysis.
Evolutionary Tracking	Do not track malware evolution	Tracks the evolution and lineage using dendrogram tree.
Complexity Handling	Struggles with new and complex malware types.	Can handle complex and new variants of malware.

Malware, being a big threat has caught attention towards it from cyber security professionals because of its varied nature and extent of its effects. So, for detecting it machine learning algorithms were being used which are helpful in producing high detection accuracy [7]. Machine learning and deep learning algorithms learns to differentiate between malware and benign by effective training on quality datasets [8]. Malware analysis can be done in many ways. Most commonly used analysis is static analysis which is used in detecting malwares with the help of opcode features [9]. Another static analysis approach which uses frequency occurrence of each opcode extracted from portable executable malicious files [10].

Now a days, Behavior-based detection techniques are widely used in malware analysis. The main approach is that it observes the behavior of the program by monitoring and concluding whether the malware is benign or malware. The behaviors can be obtained by any of the following techniques:

Using a sandbox environment.
Continuous monitoring of system calls
Observing any file modifications.
By monitoring processes.

One such detection algorithm which used ensemble learning method namely voting classifier for detection of malware samples [11]. The limitations are many in traditional security mechanisms and to overcome it. Machine learning techniques can be used [12]. Challenges are being identified, which are mainly detection of Intrusion Detection System, spams and malware [13]. Many machine learning algorithms used support vector machines (SVM) [14,15] which were trained on android malwares until the model correctly predicted all the android malware samples.

Another most popular classification algorithm is KNN algorithm, abbreviated as K-Nearest Neighbors were trained. A model trained with mobile malware and was found to be successful in producing great accuracy [16]. Another model used KNN which was specifically used for signature-based detection [17]. A hybrid model built using Navie Bayes and Support Vector Machines was used to classify malicious android malwares [18]. It uses a combination of both which produces a high accuracy in classifying android malware samples. Random Forest classifier which used “Malimg” was used to classify which has 9,342 malware samples of 25 different malware families gave an accuracy of around 94.64% depicting the efficiency of ensemble model (Random Forest) [19]. Some machine learning algorithms were previously trained on the same dataset which was used in building the model. Many classification models were trained on same dataset and the results showed that, Extra tree classifiers was the top performer with accuracy of 99.82% and detection rate of 99.86, which is immediately followed by Random Forest which was slightly behind Extra Tree classifier with accuracy of 99.78% and detection rate of 99.89% [20].

Deep learning has been extensively used in modern tasks which can handle large amounts of data and give more accurate results when compared to traditional machine learning models. Traditional machine learning models take a lot of time in training and can even produce wrong results. Deep Neural Networks, which was trained on CIC dataset by Canadian Institute of Cybersecurity yielded an accuracy of 85.04% and detection rate of 85.17% [20]. Not all malwares are in hash code form but some malwares are in unstructured forms such as images or videos. This type needs to be handled using different techniques. One such technique which is popular for image processing are CNNs. An algorithm using CNN integrated with recurrent neural networks yielded an accuracy of 98.92% and detection rate of 98% [21]. With all the work done in the past and after analyzing the results of all individual classifiers both from machine learning and deep learning models a new and robust model has been proposed.

The overview of all the existing models and the type of dataset used for classification along with the proposed model and its dataset has been explained in Table 2. It also briefs, what kind of preprocessing techniques have been used in order to achieve better accuracy and what type of classification they are (binary or multi-class).

Table 2

Overview of existing models against proposed model.
Used Approach	Dataset	Pre-processing	Classification
Hybrid RNN [22]	NSL-KDD	Principal Component Analysis	Binary
Attention based LSTM [23]	MSCAD	PSO	Multi-Class
Catboost [24]	CIC Dataset	-	Binary
Gradient Boosting [25]	CIC Dataset	Person Correlation	Binary
Deep Belief Networks [26]	Microsoft Malware Dataset	Auto-Encoder	Binary
K-Nearest Neighbors [27]	Drebin	Feature Extract	Binary
Multi-layer Perceptron [28]	Android Malwares	-	Binary
Stacking Classifiers (Proposed Model)	CIC Dataset	Autoencoder-Decoders	Binary

Stacking Classifiers: Stacking classifiers, an ensemble technique, utilizes the combination of several machine learning methods to increase the model's prediction performance. Stacking classifiers have been shown to be the useful in malware detection in recent researches. For example, the effectiveness of stacking classifiers in classifying malware datasets by analyzing hash codes showed good results and performed effectively [29]. They discovered that stacking classifiers beat separate techniques in terms of their efficiency metrics, implying that they have the potential to improve malware detection systems.

Another example, of a stack-based malware detection framework was presented in a separate research paper which uses stacking to build various base classifiers to detect Android malware [30]. In a study, it was found that stacking improves malware detection accuracy significantly compared to a single classifier. Thus, the study highlights the importance of stack classifiers in building strong malware detection frameworks which can dynamically adjust to malware.

To build an efficient machine learning and deep learning models, there is a need of some important preprocessing techniques like feature scaling and dimensionality reduction. Dimensionality reduction is needed a raw dataset contains a lot of features; it would be difficult for a model to train on entire features. Training with those many features can take significant amount of time and resources. Dimensionality reduction provides two main techniques: feature selection and feature extraction.

Feature Selection – Selecting a subset of the original features which are most relevant.
Feature Extraction – Creating new features by combining or transforming original features.

Under feature selection, methods like filter methods, wrapper methods and embedded methods are present. A model built using deep learning, describes a correlation-based feature selection methods which selects the best features by computing correlation between target column and other columns [31]. A novel feature selection was used in detecting malwares, which relies on modified whale optimization algorithm [32]. Malware attacks are most common among android mobiles, a new technique based on frequency differential enhancement was used in detecting android malware [33]. As malware can change their appearance or behavior to avoid detection, a efficient method was used with the combination of structural and behavioral features for reducing dimensionality and improve the quality of features [34]. Quadratic programming, a methodology used as feature selection which compares several feature selection methods and selects relevant features [35]. Feature selection method used weighted voting on CCCS-CIC-AndMal-2020 dataset, which was based on R2 scores and helped in selecting optimum features and achieved high accuracy [36]. It achieved high accuracy even after excluding 60.2% pf the features.

Among all dimensionality reduction methods, Principal Component Analysis (PCA) is the most widely used technique. It works by reducing the dimensionality of the data by selecting the most important features that capture maximum variance of the data. A model built using ANN used PCA as feature selection method for malware detection achieving high accuracy and low false positive rate [37]. Another research used unsupervised feature selection, which compared four different methods, namely PCA, Rough PCA, Unsupervised Quick Reduct (USQR) and Empirical Distribution Ranking (EDR) for malware detection, highlighting PCA’s performs well on most of the datasets [38]. For detecting and classifying ransomware, a two-stage selection method based on wrapper technique was used [39].

Modern dimensionality reduction methods also include autoencoder-decoders for feature generation. An efficient method was used in single ranker model in combination with autoencoders to perform greedy backward elimination of features [40]. An unsupervised feature ranking which was based on autoencoders was used by exploring the original feature space [41]. Autoencoder-decoders are being used now a days, due its feature representation techniques.

From evolutionary biology to cybersecurity, dendrogram tree analysis (PTA) has been used to explore the relationships and development of malware. Dendrogram trees provide a graphical representation of the ‘family tree’ of malware, providing insights into the similarities and differences between malware samples. In a study, researchers developed a scalable approach for building dendrogram trees to group large-scale malware samples [42]. The aim of this study was to improve the accuracy of clustering and reduce the burden on malware analysts by categorizing malware using dendrogram trees. Similar to this, another study presented an efficient technique to construct dendrogram trees that might be used for malware clustering [43], with a high correctness rate, the suggested method accomplished clustering 22 times quicker than with conventional techniques. This demonstrates how dendrogram tree analysis may be used to effectively handle and classify thousands of malware specimens.

Dendrogram tree analysis and stacking classifiers combined offer a comprehensive method for classifying and analyzing malware. Their separate advantages imply that their combined use could result in notable progress in malware detection. The utilization of several methods by stacking classifiers yields a strong prediction model, whilst dendrogram tree research provides an in-depth comprehension of malware evolution and linkages. Combining these techniques could result in the creation of complex malware detection systems that are able to recognize malware with accuracy as well as anticipate and adjust to new variations. This would enable the forecast of threats and the creation of efficient countermeasures, which would be a major advancement in proactive cybersecurity.

In brief, dendrogram tree analysis and stacking classifiers are effective methods for classifying and analyzing malware. With this possible combination might completely transform the industry and offer effective methods for defending off the constantly changing danger landscape of cyberattacks. It is impossible to overestimate the significance of such sophisticated techniques in guaranteeing digital security, given the ongoing evolution of malware. In order to fully realize the promise of these approaches when working together to combat malware, future research should concentrate on examining how they complement one another.

In this paper, a combined stacking ensemble learning model called "StackedAlgo" is proposed for analyzing obscured malware on the network. To fully understand and grasp the entire process and structure of this approach, the detailed description is divided into four sections.

Section 3.1. provides an overview of the model and its general structure.

Section 3.2. outlines the characteristics of the dataset used in this study.

Section 3.3. Deals with the Pre-processing.

Section 3.4. Performs stacked ensemble model building.

Section 3.5. Constructing dendrogram.

3.1 Proposed Architecture

The proposed architecture consists of two sequential sub-modules which are depicted in Fig. 1. a data preprocessing module and our main module, stacking model for malware classification.

The functioning of first module is subdivided into two parts: preparing dataset for analysis and also feature transformations. To begin with, the preprocessing module starts with transforming features which include converting categorical features into numerical values using “LabelEncoder” or “OneHotEncoder”. Which is immediately followed with standardizing data with the help of “MinMaxScaler” or “StandardScaler”.

Next, it also helps in feature generation. As raw dataset contains too many features which can contribute to the model, training all features can take significant amount of training time and resources. So, a technique is required to compress the features and obtain only relevant features. This can be achieved by using “autoencoders-decoders” which take features as input and produce compressed features as output from input features.

3.2 Description of Dataset Used

A good dataset plays an important role in developing a powerful and efficient model. It helps in deciding the performance and reliability of a malware classification model. The dataset used keenly looks like a real-world structure.

The dataset contains a total of 56 features representing two widely identified labels, namely Malware and Benign. The dataset consists of 50% of Benign samples and 50% of Malware samples which are depicted in Fig. 2.

3.3 Data Preprocessing

The first-phase of preprocessing module is responsible for converting all the features into numeric form. Almost all the features in our dataset are numerical except the label class which is of categorical. These categorical column needs to be converted as machine only able to understand numeric data. To resolve this, we are using label encoding techniques.

Feature scaling is important in almost all machine learning algorithms as it ensures that all numerical features used to train the models are on same scale. It helps algorithms converge faster, prevents features from dominating and improves overall performance and stability of the model. Table 3shows how the features looked before feature scaling.

Table 3

Part of dataset before feature scaling.
pslist.npro	pslist.nppi	…	dlllist.ndlls	dlllist.avg_dlls_per_proc
45	17	…	1694	38.50000
47	19	…	2074	44.12766
40	14	…	1932	48.30000

The second-phase deals with scaling the features which is in our case achieved with standardizing each feature in the dataset. This helps in enhancing the performance and evaluation metrics of the model by eliminating bias between features. Eq. (1) helps us to perform this phase.

$${Data}_{standard}=\frac{Data- \mu \left(Data\right)}{{\sigma }\left(\text{D}\text{a}\text{t}\text{a}\right)}$$

By using Eq. (1) features can be scaled and Table 4shows how features look after scaling.

Table 4
Features of dataset after scaling.
pslist.npro	pslist.nppi	…	dlllist.ndlls	dlllist.avg_dlls_per_proc
0.624044	0.890519	…	-0.354192	-0.906971
0.970233	1.613326	…	-0.047165	0.073120
-0.241427	0.268691	…	0.363994	0.799759

A dataset might contain more features or dimensions which can lead to complexity and lead to take too much of time for training the model. As our dataset contains more dimensions, we need a mechanism which can either reduce the dimensions or compress the dimensions without losing information. One such mechanism which can be very handy is using Autoencoder-decoder, which takes all he features as input and produce specified and compressed version of features without losing any data or information thereby improving the accuracy in overall model performance. Table 5 gives generated features.

Table 5
Generated features using Autoencoders-decoders.
Feature1	Feature2	Feature3	…	Feature14
2.548658	2.536681	0.046863	…	2.237395
2.882551	2.723441	1.538755	…	1.497944
3.001921	3.109818	1.860556	…	2.063411

3.4 StackedAlgo

The proposed Stacking, or Stacked Generalization, is an ensemble machine learning algorithm. It works by combining predictions from multiple models on the same dataset. Two levels of models, known as base learners, are trained on the data, and their estimates are accumulated. Another model, called the meta learner, learns by combining these predictions. The advantage of stacking is that it can bind the capabilities of a range of well-performing models and make predictions that have better performance than any individual model in the ensemble. The whole process is depicted in Fig. 3.

The steps involved in Fig. 3. are as follows:

Step1. Selecting base models.

Step2. Training data is sent to all base models (M1, M2, M3).

Step3. Each individual classifier gives prediction (P1, P2, P3).

Step4. All individual classifiers output is sent to meta-classifier (M).

Step5. The metaclassifier predicts whether it is benign or malware.

The Algorithm is for proposed stacking classifiers using autoencoder-decoder.

Algorithm : Stacking Classifier with Autoencoder-Decoder Feature Generation
	Input: D_train, D_test: training and testing datasets.
	Output: Final predictions on the test dataset
1	Preprocess Data:
2		Preprocessing with standardization to ensure consistent scale across features.
3	Autoencoder-Decoder based Feature Generation:
4		Train an autoencoder on D_train to learn feature representations.
5		Transform D_train and D_test to obtain new feature sets F_train and F_test.
6		The autoencoder-decoder consists of encoder(f) and a decoder(g).
7		$z\left(for encoder\right)=f(x; {\theta }_{e})$
8		$x\left(for decoder\right)=g(z; {\theta }_{d})$
9	Train base classifiers: For each classifier in {M₁, M₂, …, M_n} do
10		Train M_i on F_train.
11		Predict on F_train and F_test to get predictions from base classifiers.
12	Train meta-classifiers: Combine the predictions of the base classifiers by
13	$Stacking classifier\left(x\right)=P\left(\left[{M}_{1}\left(x\right), {M}_{2}\left(x\right), \dots , {M}_{n}\left(x\right)\right]\right)$
14	Make final predictions
15		The final predictions are obtained by applying the stacking classifier autoencoder-decoder.
16		$Stacking classifier\left(x\right)=P\left(\left[{M}_{1}\left(f\left(x; {\theta }_{e}\right)\right), {M}_{2}\left(f\left(x; {\theta }_{e}\right)\right), \dots , {M}_{n}\left(f\left(x; {\theta }_{e}\right)\right)\right]\right)$
17	Return final predictions

3.5 Dendrogram Construction

A dendrogram is a tree-like diagram that visually represents the hierarchical clustering of malware samples. Each leaf of the dendrogram represents a malware sample, and the branches represent the hierarchical relationships between them. The construction of a dendrogram begins by treating each malware sample as an individual cluster. Then, based on a chosen similarity measure, the two most similar clusters are merged at each step. This process continues iteratively until all samples are merged into a single cluster. The height of the branches in the dendrogram corresponds to the similarity measure, providing insights into the relationships between different malware samples. This visualization aids in understanding the ancestral relationships between malware samples, thereby enhancing the process of malware classification.

Almost all classification algorithms rely on evaluation criteria called Confusion Matrix. A confusion matrix depicted in Fig. 4., is used to give information about the model performance.

Where,

True Positive = Malware samples which are classified as malware samples.
False Positive = Benign samples which are classified as malware samples.
False Negative = Malware samples which are classified as Benign samples.
True Negative = Benign samples which are classified as benign samples.

The most widely accepted metrics for malware classification are Accuracy, Detection Rate and False Positive Rate.

1) Accuracy tells how many malware samples were correctly out of all the samples in the dataset. Higher accuracy indicates better model performance.

$\text{A}\text{c}\text{c}\text{u}\text{r}\text{a}\text{c}\text{y}=\frac{TP+TN}{\text{T}\text{P}+\text{T}\text{N}+\text{F}\text{P}+\text{F}\text{N}}$ (Equ 2)

2) False Positive Rate tells the proportion of positive cases that were incorrectly classified. The lower it is the better model performance.

$\text{F}\text{P}\text{R}=\frac{\text{F}\text{P}}{\text{F}\text{P}+\text{T}\text{N}}$ (Equ 3)

3) Detection Rate also called as Recall, True Positive Rate, is the ratio of successfully classified samples to the total number of malware samples in the test set.

$\text{D}\text{R}=\frac{\text{T}\text{P}}{\text{T}\text{P}+\text{F}\text{N}}$ (Equ 4)

A good model needs to score best results in all aspects so, to begin with selection of good base classifiers plays a crucial part in the entire model performance has explained in the following sections.

5.1 Selection of base classifiers

In this, different individual classifiers are trained and tested with the dataset and the results were analyzed. The best base classifiers need to be selected with which the final model can achieve better accuracy and FPR. The confusion matrix of base classifiers is depicted in Fig. 5.

With the help of confusion matrices from Fig. 5., we can calculate accuracy, FPR and recall using Equ (2), Equ(3) and Equ(4) respectively. The accuracy scores of all classifiers are depicted in Table 6 and corresponding line graph is represented in Fig. 6.

Table 6

Accuracy scores of individual classifiers.
Classifier	Accuracy (%)
Logistic Regression	99.47
Support Vector Machine	98.07
K Nearest Neighbors	99.96
Naïve Bayes	94.37
Decision Tree Classifier	99.93
Random Forest Classifier	99.95

From Table 6 and Fig. 6., a conclusion can be made, when compared to all the individual classifiers. The classifiers with high accuracy scores are KNN, Decision Trees and Random Forest.

The false positive rates of all classifiers are depicted in Table 7 and corresponding line graph is represented in Fig. 7.

Table 7

False Positive Rates of individual classifiers.
Classifier	False Positive Rate (%)
Logistic Regression	0.43
Support Vector Machine	3.85
K Nearest Neighbors	0.00
Naïve Bayes	10.64
Decision Tree Classifier	0.03
Random Forest Classifier	0.03

From Table 7 and Fig. 7., a conclusion can be made, when compared among all the individual classifiers. The best performing classifiers are KNN, Decision Tree and Random Forest which have less FPR’s.

For better evaluation, detection rates (recall) also calculated and are depicted in Table 8 and corresponding line graph is represented in Fig. 8.

Table 8

Detection Rates of individual classifiers.
Classifier	Detection Rate (%)
Logistic Regression	99.36
Support Vector Machine	99.95
K Nearest Neighbors	99.91
Naïve Bayes	99.16
Decision Tree Classifier	99.90
Random Forest Classifier	99.93

From Table 8 and Fig. 8., a conclusion can be made, when compared against all the individual classifiers. The best performing classifiers are SVM, KNN and Random Forest which have high detection rates.

Table 9 shows the overview of all performance metrics of individual classifiers which are being trained with the scaled and selected features. The observation is very clear that there is a little or minimal difference between individual models’ accuracy. So, we need to apply brute force approach to get the best and performance efficient models from individual models.

Table 9

Comparison of different individual classifiers for first layer stacking.
Metrics	Accuracy (%)	FPR (%)	Detection Rate (%)
Base Classifier	Accuracy (%)	FPR (%)	Detection Rate (%)
Logistic Regression	99.47	0.43	99.36
Support Vector Machine	98.07	3.85	99.95
K Nearest Neighbors	99.96	0.00	99.91
Naïve Bayes	99.37	10.64	99.16
Decision Trees	99.93	0.03	99.90
Random Forest	99.95	0.03	99.93

5.2 Stacked Model Selection

After going through many combinations of models from Table 9. All the combination of individual models and their evaluation metrics has been mentioned in Table 10, which represents comparative analysis of the performance metrics of all stacked models.

Table 10

Comparison of different base classifiers and meta classifier.
Metrics		Accuracy (%)	FPR (%)	Detection Rate (%)
Base Classifier	Meta Classifier	Accuracy (%)	FPR (%)	Detection Rate (%)
KNN + NB + RF	SVM	99.97	0.017	99.95
LR + KNN + NB	SVM	99.62	0.397	99.64
NB + RF + DT	KNN	99.92	0.017	99.86
LR + SVM + KNN (Proposed Model)	NB	99.97	0.034	99.97

5.3 Proposed Model

The final model has been efficiently trained with train dataset with reduced features and also performed well with the test dataset. To evaluate the StackedAlgo model metrics like Confusion Matrix, Accuracy, FPR and DR has been used.

Confusion Matrix is an evaluation metrics for classification models which can derive all other important metrics used to evaluate classification models. Figure 9., depicts confusion matrix for the proposed model StackedAlgo. From the confusion matrix, a total of 11,714 samples have been classified correctly out of 11,720 samples in the dataset. The proposed model is better when compared with other models.

Accuracy is another important metrics which tells how good is the model and how well it is performing with the test data. The proposed model yields 99.97% accuracy and is also a better performing algorithm among other stacked models as shown in Fig. 10.

False Positive Rate tells the proportion of positive cases that were incorrectly classified. Figure 11., clearly shows that “StackedAlgo” produces a FPR of 0.034 which is better when compared with overall performance.

Detection Rate (Recall) gives the ratio of successfully classified samples to the total number of malware samples in the test set. From Fig. 12., the model proposed has a detection rate of 99.96%.

5.4 Visualization of Malware Clusters

Visualization can help gain knowledge of data with in small amount of time. So, for the model dendrogram is used to know the family of the malware sample and group them according to their similarity. Figure 13., depicts the final dendrogram for the dataset used. The line at y = 150 tells that a total of 3 clusters are possible and all the malware samples come under this clusters. The clusters can be determined by finding the largest vertical line which doesn’t get cut by any horizontal line. The number of vertical lines formed after finding are number of desired clusters for our dataset.

This paper presents a dynamic as well as an effective approach to malware classification, leveraging dendrogram clustering concepts and semantic code analysis. The proposed approach not only enhances the recognition of existing malware families and also aids in the detection of new variants. The method’s robustness is demonstrated by its high accuracy of 99.97% and a low false positive rate of 0.0345%. These results indicate that the proposed method is highly efficient and reliable in the ever-evolving cyber threat landscape. It provides a promising direction for future research and development in malware analysis, potentially leading to more secure systems and networks. The study underscores the importance of continuous innovation in cybersecurity techniques to keep pace with the rapid evolution of malware.

Ethics Approval

Not applicable.

Data Availability

The datasets generated and/or analyzed in this study is openly available in the “PacktPublishing/Mastering-Machine-Learning-for-Penetration-Testing” repository, which can be accessed at https://github.com/PacktPublishing/Mastering-Machine-Learning-for-Penetration-Testing/blob/master/Chapter03/MalwareData.csv.gz.

Funding

No funding was received for conducting this study.

Consent for publication

Yes

Conflict of interest

The authors have no conflicts of interest to declare that are relevant to the content of this article.

Shaukat K, Alam TM, Hameed IA, Khan WA, Abbas N, Luo S (2021a) A review on security challenges in internet of things (IoT).
Damodaran A, Troia FD, Visaggio CA, Austin TH, Stamp M (2017) A comparison of static, dynamic, and hybrid analysis for malware detection. Journal of Computer Virology and Hacking Techniques.
Sihwail R, Omar K, Zainol Ariffin K, Afghani A (2019) S. Malware detection approach based on artifacts in memory image and dynamic analysis
Taha A, Barukab O (2022) Android Malware Classification Using Optimized Ensemble Learning Based on Genetic Algorithms.
Dhanya L, Chitra R, Anusha Bamini AM (2022) ‘Performance evaluation of various ensemble classifiers for malware detection’
https://docs.scipy.org/doc/scipy/reference/generated/scipy.cluster.hierarchy.dendrogram.html
Mat SRT, Razak MA, Kahar MA, Mohamad J, S.Firdaus (2021) Towards a systematic description of the field using bibliometric analysis. Malware evolution.
Abdallah A, Albogamy FR (2022) An Optimal Framework for SDN Based on Deep Neural Network.
Hashemi H, Hamzeh A (2019) Visual malware detection using local malicious pattern. Journal of Computer Virology and Hacking Techniques.
Sun Z, Rao Z, Chen J, Xu R, He D, Yang H, Liu J (2019) An opcode sequences analysis method for unknown malware detection.
Aurangzeb S, Aleem M (2023) Evaluation and classification of obfuscated Android malware through deep learning using ensemble voting mechanism
Shaukat K, Luo S, Varadharajan V, Hameed IA, Chen S, Liu D, Li J (2020a) Performance comparison and current challenges of using machine learning techniques in cybersecurity
Shaukat K, Luo S, Varadharajan V, Hameed IA, Xu M (2020b) A survey on machine learning techniques for cyber security in the last decade.
Han H, Lim S, Suh K (2020) Enhanced android malware detection: An svm-based machine learning approach
Singh P, Borgohain S, Kumar J (2022) Performance Enhancement of SVM-based ML. Malware Detection Model Using Data Preprocessing
Baldini G (2019) A performance evaluation on distance measures in KNN for mobile malware detection
Assegie TA (2021) An optimized KNN model for signature-based malware detection
Yilmaz T, Koklu (2022) Classification of Malicious Android Applications using Naïve. Bayes and Support Vector Machine Algorithms
Felan Carlo, Garcia, Felix PM (2020) Random Forest for Malware Classification
Roy KS, Ahmed T, Udas PB, Md EK (2023) A hybrid stacked ensemble learning framework with feature engineering schemes for obfuscated malware analysis
Jeon M (2020) Malware-detection method with a convolutional recurrent neural network using opcode sequences
Udas PB, Karim ME, Roy KS (2022) SPIDER: A shallow PCA based network intrusion detection system with enhanced recurrent neural networks
Udas PB, Roy KS, Karim ME, Ullah A, S. M (2023) Attention-based RNN architecture for detecting multi-step cyber-attack using PSO metaheuristic
Dang Q-V (2022) Enhancing obfuscated malware detection with machine learning techniques
Louk MHL, Tama BA (2022) Tree-based classifier ensembles for PE malware analysis. A performance revisit
Yuxin D, Siyi Z (2019) Malware detection based on deep learning algorithm. Neural Computing & Application
Cai L, Li Y, Xiong Z (2021) JOWMDroid: Android malware detection based on feature weighting with joint optimization of weight-mapping and classifier parameters
Mahindru A, Sangal AL (2021) MLDroid—Framework for Android malware detection using machine learning techniques
Kavitha PM, Muruganantham B (2021) A An Extensive Review on Malware Classification based on classifiers.
Xie N, Zhaowei Qin, Xiaoqiang Di A (2023) Android Malware Detection Based on Genetic Algorithm Optimized Stacking
Alomari ES, Nuiaa RR, Zaid Abdi Alkareem Alyasseri (2023) Malware Detection using Deep Learning and Correlation-Based Feature Selection
Riyadh Rahef Nuiaa Al Ogaili, Alomari ES, Shankar Karuppayah (2023) Malware cyberattacks detection using a novel feature selection method based on a modified whale optimization algorithm
Li X, Kong K, Xu S, Qin P (2021) Daojing He Feature selection-based android malware adversarial sample generation and detection method
Emmanuel Masabo JS, Kaawaase D (2020) Hanyurwimfura Improvement of malware classification using Hybrid Feature Engineering
Jemal Abawajy A, Darem, Asma AA (2021) ‘Feature Subset Selection for Malware Detection in Smart IoT Platforms’
Islam R, Sayed MI, Saha S Mohammad Jamal Hossain and Md Abdul Masud (2022), ‘Android malware Classification using Optimum Feature Selection and Ensemble Machine Learning’
Jason Zhang (2019) ‘Machine Learning with feature selection using Principal Component Analysis for malware detection&#8217
Nisthana, Parveen (2020) Hannah Inbarani and Sathish kumar. ‘Performance Analysis of Unsupervised Feature Selction Methods’
Abbasi MS, Harith Al-Sahaf and Ian Welch (2020) ‘{article Swarm Optimization: A Wrapper-based feature selection method for ransomware detection and classification&#8217
Sharan Ramjee, Aly El Gamal (2020) ‘Efficient Wrapper Feature Selection using Autoencoder and Model Based Elimination’
Sharifipour S, Fayyazi H (2019) Mohammad Sabokrou and Ehsan Adeli. ‘Unsupervised feature ranking and selection based on autoencoders’
He T, Han C, Tanaka A, Takahashi T, Jun'ichi Takeuchi A (2023) New seed set Selection Method. of the Scalable Method for Constructing Dendrogram Trees’
He T, Han C, Isawa R, Takahashi T Shuji Kijima, Jun’ichi Takeuchi & Koji Nakao, A 2019, ‘A Fast Algorithm for constructing Dendrogram Trees with Application to IoT Clustering’

No competing interests reported.

Download PDF

Version 1

posted

You are reading this latest preprint version

A Robust Method for Malware Analysis Using Stacking Classifiers and Dendrogram Visualization

Status:

Version 1

Abstract

Figures

1 Introduction

2 Literature Review

3 Proposed Approach

3.1 Proposed Architecture

3.2 Description of Dataset Used

3.3 Data Preprocessing

3.4 StackedAlgo

3.5 Dendrogram Construction

4 Evaluation Metrics

5 Implementation & Results

5.1 Selection of base classifiers

5.2 Stacked Model Selection

5.3 Proposed Model

5.4 Visualization of Malware Clusters

6 Conclusion

Declarations

References

Additional Declarations

Status:

Version 1