An Insight into the Machine-Learning-Based Fileless Malware Detection.

Area of Science:

• Cybersecurity
• Machine Learning
• Malware Analysis

Background:

• The malware industry has evolved, with cybercriminals increasingly using fileless malware, which operates without traditional files.
• Fileless malware evades conventional detection methods by leveraging benign system processes, posing a significant threat.

Purpose of the Study:

• To propose and evaluate a novel machine learning-based detection technique for fileless malware.
• To analyze the effectiveness of various machine learning algorithms in identifying fileless threats through feature extraction from memory dumps.

Main Methods:

• Memory dumps were acquired from virtual machines executing both malicious and non-malicious samples.
• Features were extracted using the Volatility memory forensics tool and analyzed with machine learning classifiers.
• The Random Forest algorithm was selected based on k-fold cross-validation scores.

Main Results:

• The Random Forest classifier achieved an overall accuracy of 93.33%.
• It demonstrated a True Positive Rate (TPR) of 87.5% at a zero False Positive Rate (FPR).
• This performance surpassed other evaluated algorithms including Decision Tree, SVM, Logistic Regression, KNN, XGBoost, and Gradient Boosting.

Conclusions:

• Machine learning, specifically the Random Forest algorithm applied to memory forensics, is effective for detecting fileless malware.
• The proposed method offers a promising solution for enhancing cybersecurity against advanced fileless threats.