Memory Visualization-Based Malware Detection Technique

Area of Science:

• Cybersecurity
• Machine Learning
• Data Engineering

Background:

• Advanced Persistent Threats (APTs) pose significant risks, especially when combined with polymorphic malware that evades detection.
• Existing malware detection methods using memory visualization lack effective preprocessing, leading to overfitting and poor generalization.
• Polymorphic malware's ability to generate variants and reside in main memory makes it particularly challenging to identify.

Purpose of the Study:

• To develop a new data engineering approach for enhancing malware detection.
• To address the overfitting and generalization issues in memory-based malware visualization techniques.
• To improve the accuracy and efficiency of detecting polymorphic malware within Advanced Persistent Threats.

Main Methods:

• Introduced a two-stage data engineering approach: Denoising and Re-Dimensioning.
• Denoising stage: Reduced noise in memory dump-based malware images.
• Re-Dimensioning stage: Compressed cleaned images to reduce dimensionality, mitigating overfitting and computational overhead.

Main Results:

• Achieved high performance metrics: 97.82% accuracy, 97.66% precision, 97.25% recall, and 97.57% F1-score.
• Outperformed existing solutions by 0.83% in accuracy, 0.30% in precision, 1.67% in recall, and 1.25% in F1-score.
• Significantly reduced computational time and memory usage compared to prior methods.

Conclusions:

• The proposed data engineering approach effectively enhances machine learning models for malware detection.
• The Denoising and Re-Dimensioning stages are crucial for overcoming limitations in current memory-based visualization techniques.
• This method offers a more accurate, efficient, and generalizable solution for identifying polymorphic malware in APTs.