加强勒索软件防御:基于深度学习的检测和对不断变化的威胁的家族智能分类
Amjad Hussain1, Ayesha Saadia2, Musaed Alhussein3
1Department of Cyber Security, Air University, Islamabad, Pakistan.
PeerJ. Computer science
|December 16, 2024
概括
一种新的深度学习方法,以群体正常化为基础的双向长期短期记忆 (GN-BiLSTM),可以准确地检测和分类勒索软件变体. 这种方法通过识别恶意软件家族和类别来增强网络安全,这对于防止未来攻击至关重要.
科学领域:
- 网络安全 网络安全
- 机器学习 机器学习
- 深度学习 (Deep Learning) 是一种深度学习.
背景情况:
- 勒索软件利用模糊化技术,使得检测和分类对传统方法具有挑战性.
- 现有的机器学习方法与先进的,模糊的勒索软件变体作斗争.
- 深度学习为分析和分类复杂恶意软件提供了先进的功能.
研究的目的:
- 解决勒索软件检测和家族归因中的多类分类挑战.
- 提出和验证一种新的深度学习模型,用于增强勒索软件识别.
- 为了提高检测和分类新的勒索软件变体的准确性.
主要方法:
- 开发一种新的基于群体规范化的双向长期短期记忆 (GN-BiLSTM) 模型.
- 在CIC-MalMem-2022模糊恶意软件数据集上对GN-BiLSTM模型的培训和验证.
- 与其他五种性能评估深度学习模型进行比较分析.
主要成果:
- 在CIC-MalMem-2022数据集上,GN-BiLSTM模型在勒索软件检测中实现了99.99%的准确性.
- 按类别分类的准确率达到85.48%,家庭识别准确率为74.65%.
- 在一个自我收集的数据集上,该模型显示了99.20%的检测,97.44%的类别分类和96.23%的家庭识别准确度.
结论:
- 提出的GN-BiLSTM方法在检测和分类勒索软件变体方面表现出卓越的性能.
- 这种深度学习方法有效地识别恶意软件类别和家族,即使有模糊.
- 该模型显示了在先进的勒索软件检测系统中实现现实世界的巨大潜力.
相关概念视频
01:22Force Classification
Forces play a crucial role in the study of physics and engineering. They are essential in describing the motion, behavior, and equilibrium of objects in the physical world. Forces can be classified based on their origin, type, and direction of action.
Contact and non-contact forces are two of the most widely used categories of forces. As the name suggests, contact forces require physical contact between two objects to act upon each other. Examples of contact forces include frictional,...
Contact and non-contact forces are two of the most widely used categories of forces. As the name suggests, contact forces require physical contact between two objects to act upon each other. Examples of contact forces include frictional,...
01:30Classification of Signals
In signal processing, signals are classified based on various characteristics: continuous-time versus discrete-time, periodic versus aperiodic, analog versus digital, and causal versus noncausal. Each category highlights distinct properties crucial for understanding and manipulating signals.
A continuous-time signal holds a value at every instant in time, representing information seamlessly. In contrast, a discrete-time signal holds values only at specific moments, often denoted as x(n), where...
A continuous-time signal holds a value at every instant in time, representing information seamlessly. In contrast, a discrete-time signal holds values only at specific moments, often denoted as x(n), where...
01:26Classification of Systems-I
Linearity is a system property characterized by a direct input-output relationship, combining homogeneity and additivity.
Homogeneity dictates that if an input x(t) is multiplied by a constant c, the output y(t) is multiplied by the same constant. Mathematically, this is expressed as:
Homogeneity dictates that if an input x(t) is multiplied by a constant c, the output y(t) is multiplied by the same constant. Mathematically, this is expressed as:
01:31Classification of Systems-II
Continuous-time systems have continuous input and output signals, with time measured continuously. These systems are generally defined by differential or algebraic equations. For instance, in an RC circuit, the relationship between input and output voltage is expressed through a differential equation derived from Ohm's law and the capacitor relation,