Obfuscated Malware Detection and Classification in Network Traffic Leveraging Hybrid Large Language Models and...

Area of Science:

• Cybersecurity
• Mobile Security
• Artificial Intelligence

Background:

• Android malware poses a significant threat due to the OS's popularity.
• Existing malware analysis methods face challenges with data scarcity due to privacy concerns.
• Network traffic analysis is crucial for detecting malicious components in Android applications.

Purpose of the Study:

• To propose a novel smart sensing model, Syn-detect, for Android malware detection and classification.
• To address the challenge of limited network traffic data in malware analysis.
• To leverage large language models (LLMs) for enhanced malware classification.

Main Methods:

• A two-step approach: generating synthetic TCP malware traffic using GPT-2 and classifying malware using a fine-tuned Bidirectional Encoder Representations from Transformers (BERT) model.
• Utilizing BERT for tokenization, word embedding generation, and classification of network traffic data.
• Testing the Syn-detect model on the CIC-AndMal2017 and CIC-AAGM2017 Android malware datasets.

Main Results:

• Syn-detect achieved high accuracy, reaching 99.8% on CIC-AndMal2017 and 99.3% on CIC-AAGM2017.
• Matthew's Correlation Coefficient (MCC) values were 99% for CIC-AndMal2017 and 98% for CIC-AAGM2017, indicating strong predictive performance.
• The model outperformed existing approaches in Android malware classification.

Conclusions:

• The Syn-detect model demonstrates robust performance in classifying network traffic-based Android malware.
• The use of LLMs, including GPT-2 for data synthesis and BERT for classification, proves effective in overcoming data scarcity challenges.
• Syn-detect offers a promising advancement in mobile security and Android malware detection research.