Next-generation antivirus for Java']JavaScript malware detection based on dynamic features

被引:3
|
作者
de Lima, Sidney M. L. [1 ]
Souza, Danilo M. [2 ]
Pinheiro, Ricardo P. [2 ]
Silva, Sthefano H. M. T. [2 ]
Lopes, Petronio G. [2 ]
de Lima, Rafael D. T. [2 ]
de Oliveira, Jemerson R. [2 ]
Monteiro, Thyago de A. [2 ]
Fernandes, Sergio M. M. [2 ]
Albuquerque, Edison de Q. [2 ]
da Silva, Washington W. A. [3 ]
dos Santos, Wellington P. [3 ]
机构
[1] Univ Fed Pernambuco, Elect & Syst Dept, Recife, Brazil
[2] Univ Pernambuco, Comp Dept, Recife, Brazil
[3] Univ Fed Pernambuco, Biomed Engn Dept, Recife, Brazil
关键词
Malware; !text type='Java']Java[!/text]Script; Sandbox; Dynamic features; Machine learning; Antivirus; Computer forensics; CLASSIFICATION;
D O I
10.1007/s10115-023-01978-4
中图分类号
TP18 [人工智能理论];
学科分类号
081104 ; 0812 ; 0835 ; 1405 ;
摘要
There are many kinds of Exploit Kits, each one being built with several vulnerabilities, but almost all of them are written in JavaScript. So, we created an antivirus, endowed with machine learning, expert in detecting JavaScript malware based on Runtime Behaviors. In our methodology, JavaScript is executed, in a controlled environment. The goal was to investigate suspicious file behavior. Our antivirus, as a whole, dynamically monitors and ponders 7690 suspicious behaviors that the JavaScript file can do in Windows 7. As experiments, the authorial antivirus is compared to antiviruses based on deep as based on shallow networks. Our antivirus achieves an average accuracy of 99.75% in the distinction between benign and malware, accompanied by a training time of 8.92 s. Establishing the relationship between accuracy and training time is essential in information security. Eight (8) new malware are released every second. An antivirus with excessive training time can become obsolete even when released. As our proposed model can overcome the limitations of state-of-the-art, our antivirus combines high accuracy and fast training. In addition, the authorial antivirus is able to detect JavaScript malware, endowed with digital antiforense, such as obfuscates, polymorphic and fileless attacks.
引用
收藏
页码:1337 / 1370
页数:34
相关论文
共 50 条
  • [1] Next-generation antivirus for JavaScript malware detection based on dynamic features
    Sidney M. L. de Lima
    Danilo M. Souza
    Ricardo P. Pinheiro
    Sthéfano H. M. T. Silva
    Petrônio G. Lopes
    Rafael D. T. de Lima
    Jemerson R. de Oliveira
    Thyago de A. Monteiro
    Sérgio M. M. Fernandes
    Edison de Q. Albuquerque
    Washington W. A. da Silva
    Wellington P. dos Santos
    [J]. Knowledge and Information Systems, 2024, 66 : 1337 - 1370
  • [2] Next Generation Antivirus Applied to Jar Malware Detection based on Runtime Behaviors using Neural Networks
    Pinheiro, Ricardo
    Lima, Sidney
    Fernandes, Sergio
    Albuquerque, Edison
    Medeiros, Sergio
    Souza, Denilo
    Monteiro, Thyago
    Lopes, Petronio
    Lima, Rafael
    Oliveira, Jemerson
    Silva, Sthefano
    [J]. PROCEEDINGS OF THE 2019 IEEE 23RD INTERNATIONAL CONFERENCE ON COMPUTER SUPPORTED COOPERATIVE WORK IN DESIGN (CSCWD), 2019, : 28 - 32
  • [3] Novel Java']JavaScript malware detection based on fuzzy Petri nets
    Lin, Yi-Nan
    Wang, Sheng-Kuan
    Yang, Cheng-Ying
    Shen, Victor R. L.
    Juang, Tony Tong-Ying
    Wei, Chin -Shan
    [J]. JOURNAL OF INTELLIGENT & FUZZY SYSTEMS, 2020, 39 (01) : 249 - 261
  • [4] Bivariate Classification of Malware in Java']JavaScript using Dynamic Analysis
    Gupta, Yash
    Bansal, Divya
    Sofat, Sanjeev
    [J]. PROCEEDINGS OF THE 1ST INTERNATIONAL WORKSHOP ON CLOUD COMPUTING AND INFORMATION SECURITY (CCIS 2013), 2013, 52 : 178 - 182
  • [5] Swarm virus - Next-generation virus and antivirus paradigm?
    Zelinka, Ivan
    Das, Swagatam
    Sikora, Lubomir
    Senkerik, Roman
    [J]. SWARM AND EVOLUTIONARY COMPUTATION, 2018, 43 : 207 - 224
  • [6] Malicious Java']JavaScript Detection by Features Extraction
    Canfora, Gerardo
    Mercaldo, Francesco
    Visaggio, Corrado Aaron
    [J]. E-INFORMATICA SOFTWARE ENGINEERING JOURNAL, 2014, 8 (01) : 65 - 78
  • [7] Multiple Classifier Systems for More Accurate Java']JavaScript Malware Detection
    Yi, Zibo
    Ma, Jun
    Luo, Lei
    Yu, Jie
    Wu, Qingbo
    [J]. PROCEEDINGS OF THE INTERNATIONAL CONFERENCE ON PROMOTION OF INFORMATION TECHNOLOGY (ICPIT 2016), 2016, 66 : 139 - 143
  • [8] A Systematic Literature Review and Quality Analysis of Java']Javascript Malware Detection
    Sohan, Md. Fahimuzzman
    Basalamah, Anas
    [J]. IEEE ACCESS, 2020, 8 : 190539 - 190552
  • [9] Towards a Next-Generation Matrix Library for Java']Java
    Arndt, Holger
    Bundschus, Markus
    Naegele, Andreas
    [J]. 2009 IEEE 33RD INTERNATIONAL COMPUTER SOFTWARE AND APPLICATIONS CONFERENCE, VOLS 1 AND 2, 2009, : 460 - +
  • [10] Hunter: Next-Generation Code Reuse for Java']Java
    Wang, Yuepeng
    Feng, Yu
    Martins, Ruben
    Kaushik, Arati
    Dillig, Isil
    Reiss, Steven P.
    [J]. FSE'16: PROCEEDINGS OF THE 2016 24TH ACM SIGSOFT INTERNATIONAL SYMPOSIUM ON FOUNDATIONS OF SOFTWARE ENGINEERING, 2016, : 1028 - 1032