AU2021107489A4 - An Real Time Automated Multi-level Malware Classification and Detection Module in Networks - Google Patents

Abstract

In this proposed research work, a Security framework is designed to provide secured processing of Big Data in a Hybrid Cloud Computing environment. In each of the data nodes, a VMMC is preinstalled without the user's consent using data nodes for storage. The primaryjob of VMMC is to extract the raw memory dumps of the monitored virtual machines and send them to a centralised VMMS on time. The VMMS reconstructs the memory dumps and computes the three distinct hash values MD-5,SHA-256, and SHA-1. In the first stage, hash values were compared against the Local Malware Signature Database to match known malware. If there is no match, then hash values are compared against the publicly available malware signatures using web tools in the second stage. Since these two levels limit themselves with limited malware signatures, the third level machine learning model is designed to detect and classify the malware symptoms. The Logistic regression achieved the optimum accuracy of up to 92.4 % compared to Naive Bayes and Support Vector Machine. But it's very imperative that many true negatives (TN) of the model can compromise the model to a greater extent. In order to address the issues of the base model, the Ensemble machine learning models are used, which harness the power of subset training and then aggregating in prediction with voting. In the analysis, Random forest, Bagging, and Gradient Boosting ensemble models are used. The random forest achieved a better and acceptable accuracy of up to 98 % by lowering the true negative values and minimising the network's risk. Diagrams: MonitaredVirtual Machine MemoryDump Executable Extracted ExtractedProcesses Computer MOS, SH-2S6and SHA-1 hash Locu I Mi WaraSignturt Data bas:MDS, SHA, PresentMiwr On I inme MewretSca nr No Yes Present ~ -M~~r LocaIM ach ine Lea rn i ngMewave detector

Description

Diagrams:

MonitaredVirtual Machine MemoryDump

Executable Extracted

ExtractedProcesses

Computer MOS, SH-2S6and SHA-1 hash

LocuI Mi WaraSignturt Data bas:MDS,SHA,

PresentMiwr

On I inme MewretSca nr

No Yes

Present ~ -M~~r

LocaIM ach ine Lea rn i ngMewave detector

EDITORIAL NOTE 2021107489

There is 1 page of description only.

Description:

The proposed architecture is for enhancing security at the processing level of the operating System. The pre-configured and pre-installed VMMC, configured Virtual machine monitoring server (VMMS) leveraged as data nodes from a pool of virtual machines. The primary task of VMCC is to real-time updating to the Virtual machine monitoring server (VMMS), the status of the data node by extracting the state of information of kernel modules such as process state information, system calls, and various process invoking the system calls. Each VMM Client is responsible for updating the VMM Server in a fixed interval of time. VMM Server is responsible for scanning the received data on time to identify malware, predicting malware symptoms and threats ofits kind from a multiple live monitored guest operating system.

The proposed approach is designed to work at three levels. The first level operations are restricted to the local network. All the known patterns of malware signatures are collected to serve as the local malware signature repository. The local malware signature repository is updated as and when new malware signatures are identified. In the first level, the extracted PE hash value is matched against this local repository.

If no match is found in this local repository, it proceeds to the second level, where it tries to compare with the Online Malware Signatures. In order to do this, publicly available malware classification tools areused.

The first and second levels limit themselves with identifying known malware signatures either locally or publicly available. The proposed approach extends to the third level by adopting Machine Learning Techniques to detect new types of attacks that are not identified in Level 1 and Level 2.

In order to classify the malware in the third level, experiments are carried out with Supervised and Ensemble Machine Learning Models.

EDITORIAL NOTE 2021107489

There is 1 page of claims only.

Claims (3)

Claims:

1.In this proposed research work, a Security frameworkisdesigned toprovidesecured processing of Big Data in a Hybrid Cloud Computing environment.

2. In each of the data nodes, a VMMC is pre-installed without the user's consent using data nodes for storage. The primary job of VMMC is to extract the raw memorydumps of themonitored virtual machines and send them to a centralized VMMS on time. The VMMS reconstructs the memory dumps and computes the three distinct hash values MD-5,SHA-256, and SHA-1. In the first stage, hash values were compared against the Local Malware Signature Database to match known malware. If there is no match, then hash values are compared against the publicly available malware signatures using web tools in the second stage. Since these twolevelslimit themselves with limited malware signatures, the third level machinelearning model is designed to detect and classify themalware symptoms.

3. The Logistic regression achieved the optimum accuracy of up to 92.4 %compared to Naive Bayes and Support Vector Machine. But it's very imperative that many true negatives (TN) of the model can compromise the model to a greaterextent. In order to address the issues of the base model, the Ensemble machine learning models are used, which harness the powerof subset training and then aggregating in prediction with voting. In the analysis, Random forest, Bagging, and Gradient Boosting ensemble models are used. The random forest achieved a betterand acceptable accuracy of up to 98 %by loweringthe true negative values and minimizingthe network's risk.

EDITORIAL NOTE Aug 2021

2021107489

There is 1 drawing only.

Diagrams: