ZeVigilante: Detecting Zero-Day Malware Using Machine Learning and Sandboxing Analysis Techniques.

Area of Science:

• Cybersecurity
• Machine Learning Applications
• Malware Detection

Background:

• Zero-day malware poses a significant threat due to its evasion tactics.
• Existing detection methods struggle against sophisticated, undocumented threats.
• Advanced investigation into identification methods is crucial for cybersecurity.

Purpose of the Study:

• To propose and evaluate a novel system, Zero-Day Vigilante (ZeVigilante), for detecting zero-day malware.
• To leverage machine learning techniques within a sandboxing environment for enhanced malware identification.
• To compare the efficacy of various machine learning classifiers for static and dynamic malware analysis.

Main Methods:

• Utilized Cuckoo Sandboxing (CS) for a safe malware analysis environment.
• Implemented Zero-Day Vigilante (ZeVigilante) incorporating both static and dynamic analysis.
• Trained and tested multiple machine learning classifiers: Random Forest (RF), Neural Networks (NN), Decision Tree (DT), k-Nearest Neighbor (kNN), Naïve Bayes (NB), and Support Vector Machine (SVM) on comprehensive datasets.

Main Results:

• Random Forest (RF) demonstrated superior performance in malware detection.
• Achieved high accuracy rates: 98.21% for static analysis and 98.92% for dynamic analysis.
• The proposed ZeVigilante system effectively identified zero-day malware using selected ML classifiers.

Conclusions:

• Machine learning, particularly Random Forest, is highly effective for zero-day malware detection.
• The combination of static and dynamic analysis within a sandboxing environment offers a robust approach.
• The ZeVigilante system provides a promising solution for enhancing cybersecurity against emerging threats.