Malware and Malware Detection Techniques: A Survey

10

V

https://doi.org/10.22214/ijraset.2022.43287

May 2022

International Journal for Research in Applied Science & Engineering Technology (IJRASET) ISSN: 2321-9653; IC Value: 45.98; SJ Impact Factor: 7.538 Volume 10 Issue V May 2022- Available at www.ijraset.com

Malware and Malware Detection Techniques: A Survey Sahil Sehrawat1, Dr. Dinesh Singh2 1

Student, 2Professor, Computer Science and Engineering Department, D.C.R.U.S.T, Murthal, India

Abstract: Malicious software is a kind of software or codes which took some: private data, information from the PC framework, its tasks is to do only malicious objectives to the PC framework, without authorization of the PC clients. The effect of malicious software are worsen to the client. Malicious software i.e malwares are programs that are made to mischief, hinder or harm PCs, organizations and different assets related with it. Malwares are moved in PCs without the information on its proprietor.

Presently malicious program is a serious threat. It is created to harm the PC framework and some of them are spread over the associated framework in the organization or web association. Analysts are making great efforts in malware framework field with compelling malware detection techniques to safeguard PC framework. Two essential methodologies have been proposed for it for example signature-based and heuristic-based detection. These methodologies distinguish known malware precisely yet can't distinguish the new, obscure malware. Recently various analysts have proposed malware identification framework utilizing data mining and machine learning strategies to distinguish between obscure and non – obscure malwares. In this paper, an detailed examination has been led on the present status of malware infection and work done for finding it.

Keywords: PC framework, malicious software, heuristic-based , signature – based , zero -day malware , obscure malware I. INTRODUCTION The term malware is short form of malicious software, as the name proposes malwares are expected to harm PCs and PC client infrastructure by taking data, ruining their records. Malware is generally spreading over increase in usage of internet in this era,abd thus there is great need in expansion of security of computer.[2,11]Development of organizations is affected by malware. Malware focuses on the applications that are runs over the internet. Now a day the utilization of internet is the most indispensable piece of our day to day life. The internet program downloads various sorts of PC software. One downside of the broad use of internet is that numerous PC frameworks are powerless against assaults and get contaminated with malwares. There are various names for malware for instance malicious code, malicious program or malicious executable. Malware is malicious software which is utilized with the expectation of penetrating a PC framework's security strategy regarding confidentiality,integrity and availability of information. It can add or change or eliminate any program from the framework to purposefully hurt the framework's required capacities. Malware comes in various structures like infection, Trojan horse, spyware, scareware, adware or trapdoor and so on.

Current commercial antivirus vendors can't offer all the insurance for PC framework as a result of zero day malwares, subsequently zero day malwares need to dissect by malware analysis methods to make their signatures. The signatures-based approach has profoundly exact detection proportion yet it vulnerable in some circumstances. Like, in the event that another dangers appear, the master examiners ought to make a battle signature for them to identify them in future, and these new dangers and signatures are difficult to be distinguished. Furthermore, there will be a great deal of time span between the new dangers creation and the signatures to recognize that new danger, therefore, PCs that safeguarded by conventional signature-based approach are vulnerable to contaminate. The framework that used to distinguish malicious goal in program is known as malware detection system and it has two parts: analysis and detection. Malware detection system is a system used to determine whether a program has malicious intent or not. Malware detector is utilized as an instrument to safeguard against the malware. The characteristics of such identifiers are not entirely settled by the strategies it utilizes. It takes two data sources initially is signature or conduct boundaries of a given code and second is the program under review, it can utilize its detection method to choose if the program is malware or harmless.

II. MALWARE CLASSIFICATION The classification of malware is a troublesome process. Software that permits unauthorized control of a framework is clearly malicious.Malware comes in different structures and classes.These are normally grouped by their spread technique and their activities that are performed on the infected machine utilizing the planned malicious program. They are not mutually exclusive although many of them exist in more than one class.

©IJRASET: All Rights are Reserved | SJ Impact Factor 7.538 | ISRA Journal Impact Factor 7.894 |

3947

International Journal for Research in Applied Science & Engineering Technology (IJRASET) ISSN: 2321-9653; IC Value: 45.98; SJ Impact Factor: 7.538 Volume 10 Issue V May 2022- Available at www.ijraset.com 1) Virus: Virus contaminates PCs and different documents by recreating itself. It can't exist freely so it connects with different documents all the more unequivocally executable records and application and because of its recreating highlights, it spread across records and even PCs through network. It causes framework execution corruption and forswearing of administration .

2) Worms: Worms are malicious piece of code that exist freely. they have component to repeat itself. They engenders through capacity gadgets and messages, additionally consume organization and PC assets which prompts framework debasement in execution. As they can make various duplicates of themselves, antivirus scanners can recognize these codes in light of various existence.

3) Trojan Horse: Trojan Horse acts like a valuable program yet it has unsafe program. They don't reproduce themselves yet it moved in a PC by internet cooperation like downloading. It takes delicate data, notice movement of clients and can erase and modify or ruin documents on the framework where it resides.

4) Rootkit: Rootkit assume command over the working framework to such an extent that it cannot conceal itself or can make a safe climate for other malwares to show away in the framework. It is a concealing procedures to cheat antivirus so that they can't find malwares in the framework and think about them as ordinary applications.

5) Spyware: Spyware are utilized to take somebody individual data or keep the watch on client's exercises. It is introduced without the information on framework proprietor and furtively gather the data and send it back to the maker. Indeed, even organization with large names like google additionally use spyware to gather the expected data of their users.

6) Adware: Adware are very irritating , oftenly it plays promotion on client PC without its authorization and intrude on its ongoing movement. Fundamental motivation behind the adware is to get monetary advantage. It is as much destructive as other malwares.

7) Cookies: Cookies are in type of text document and contain data that is put away by internet browser on clients PC for sometime later. Clearly cookies are not hurtful yet they become a danger when it is utilized by some spyware.

8) Sniffers: They are the software that notice and record the organization traffic. They investigate various fields of parcels and gather data for arrangement of the malware assault.

9) Botnet: Bot is a software that permit maker to control a tainted PC. An organization PCs constrained by assailants to do malicious exercises without the information on proprietor. They can make disavowal of administration assaults, send spam messages, takes data as well.

10) Keyloggers: It is somewhat spyware that is utilized to record key strokes to take passwords , Visa subtleties what's more, other significant and touchy figures. It moved in a PC when some other malicious software is introduced or any contaminated site is visited by client.

11) Spam: Junk messages are one more names of spams. These indistinguishable messages are made and ship off various beneficiaries simultaneously. It consumes a ton of data transfer capacity and furthermore cause to dial back the framework.

12) Ransomware: Now a days Ransomware are the significant danger for internet industry. Ransomware are malwares that assume command over your PC by scrambling your information, stop some application and don't permit you utilize your working framework until you satisfy their requests. The requests are generally concerning cash. In the wake of paying cash,it is as yet not ensured that you will gain your influence back.

All malicious softwares are inexactly named as virus and furthermore the business anti-malware items are normally called antivirus.

Readers may find other, slightly different, definitions in the literature, as the borderlines between malware and malware classes are found somewhat same but have a huge difference , different malware classes have different targets.

III. MALWARE ANALYSIS TECHNIQUE Malware analysis techniques can be divided into three general classes, static based, dynamic based and hybrid based. These methods recognize and distinguish malware and take countermeasures against those malwares for the wellbeing of PC frameworks from a potential loss information and resources.

A. Static Analysis At this point, when a software or piece of code is investigated without executing, this sort of analysis is called static analysis or on the other hand code analysis. Static data is extricated from the code to decide either the software contains malicious code or not. In this method, the software is picked apart by utilizing various instruments and the design of the malicious code is investigated to comprehend how it functions. Various measures that can be utilized to perform static analysis are debugger, dissembler, decompiler and source code analyzers. Strategies which are utilizing in performing static analysis are incorporate File Format Inspection, String Extraction, Fingerprinting, AV scanning, Disassembly.

©IJRASET: All Rights are Reserved | SJ Impact Factor 7.538 | ISRA Journal Impact Factor 7.894 |

3948

International Journal for Research in Applied Science & Engineering Technology (IJRASET) ISSN: 2321-9653; IC Value: 45.98; SJ Impact Factor: 7.538 Volume 10 Issue V May 2022- Available at www.ijraset.com B. Dynamic Analysis At this point, when functionality of software is dissected and seen by executing it is known as dynamic or behavioral analysis[10].It should be possible by following the function calls, control streams and furthermore by dissecting the directions of parameters functions. Malicious code are run in a virtual climate to notice its way of behaving and to plan the activities against these negative way of behaving. The devices that are utilized for dynamic analysis are sandbox, test system, emulators RegShot, Process Explorer.

Dynamic analysis is more viable the static analysis as in this strategy, the tainted software is executed in virtual machine for checking. This can recognize numerous sorts of malwares without any problem. This kind of analysis requires some investment as we need to plan the climate to execute and test a malicious software C. Hybrid Analysis It consists of both static and dynamic analysis methods so can adopt the advantages of the two strategies. First and foremost a software is seen by code analysis by checking the malware signature and afterward it is run in virtual environment to notice its real way of behaving.

Approach Advantages Disadvantages

Static Analysis

Dynamic Analysis

Quick and safe.

Low asset utilization.

Multipath malware analysis.

Safer than dynamic analysis.

High accuracy Better than static and dynamic analysis.

Most noteworthy precision

Can't examine obscure and encryption malware.

Can't identify obscure malware

Slow and dangerous.

High asset utilization.

Tedious , powerless.

Restricted to code reachability Additional time and asset consuming.

Most complex

Can analyse obscure and encryption malware.

Preferable precision Hybrid Analysis over static analysis.

Can Detect both known and unknown malware.

Table .1. comparison between malware analysis techniques

IV. MALWARE DETECTION TECHNIQUE Malware detection techniques can be divided into three general classes, signature based, heuristic based and specification based.

These procedures distinguish and identify malware and take countermeasures against those malwares for the security of PC frameworks from a potential loss of data and assets.

A. Signature Based When a malware is composed, an arrangement of sequence commonly known as signature is implanted in its code which can later use to distinguish from which family this malware has a place with. The signature based detection technique is utilized by a large portion of the antivirus programs. The antivirus program dismantle the code of the contaminated record and look for the example that have a place with a malware family. Signatures of the malwares are kept up with in information base and afterward utilized for examination in detection process. This sort of detection technique is too known as string or example examining or coordinating. It tends to be static, dynamic or hybrid too.

©IJRASET: All Rights are Reserved | SJ Impact Factor 7.538 | ISRA Journal Impact Factor 7.894 |

3949

International Journal for Research in Applied Science & Engineering Technology (IJRASET) ISSN: 2321-9653; IC Value: 45.98; SJ Impact Factor: 7.538 Volume 10 Issue V May 2022- Available at www.ijraset.com B. Heuristic Based The heuristic based discovery distinguishes or separate between the normal and abnormal way of behaving of a framework with the goal that , at last the known and obscure malware can be recognized and settled. The heuristic based discovery process comprises of two stages. In initial step, the way of behaving of the framework is seen without any assault and track the significant data that can be confirmed and checked in the event of assault. This contrast is kept an eye out in second means to identify the malware of a specific family. Conduct locator that is utilized in heuristic based method comprise of the accompanying three essential parts.

1) Data collection: As the name recommends, this part manages the collection of data either static or dynamic.

2) Interpretation: This part decipher the data gathered from data collection part and convert it into middle structure.

3) Matching algorithm: This part is utilized for matching the conduct signature with the changed over data in the interpretation component Behavior locator is displayed in Fig.1 which makes sense of the functionality how this multitude of parts cooperate.

Fig.1. Behaviour locator C. Specification Based In specification based detection technique, applications are checked by their specification and checks for the typical and strange way of behaving. This technique comes from heuristic based technique however fundamental distinction is heuristic based detection techniques utilized AI and AI strategies to recognize substantial furthermore, however in specification based detection technique is based on the examination of the way of behaving of the framework specification[9]. This strategy is some way or another manual correlation of the ordinary exercises of some framework. It defeats the limitation of the heuristic based techniques. [1]The advantage and disadvantage of the three detection techniques are displayed in Table II. Fig.2. grouping and relationship of the malware analysis and detection techniques are shown, each of malware detection technique can be static, dynamic or hybrid and furthermore the specification based detection technique is gotten from heuristic based detection technique

Table II. Advantages and Disadvantages of Malware Detection Techniques

©IJRASET: All Rights are Reserved | SJ Impact Factor 7.538 | ISRA Journal Impact Factor 7.894 |

3950

International Journal for Research in Applied Science & Engineering Technology (IJRASET) ISSN: 2321-9653; IC Value: 45.98; SJ Impact Factor: 7.538 Volume 10 Issue V May 2022- Available at www.ijraset.com

Fig.2. Malware detection techniques V. SURVEY OF EXISTING WORK In the past segment we have introduced the malware analysis and detection technique as base of this paper work. Following table shows examination of the concentrated literature survey study papers of different techniques that are utilized to recognize the malwares using data mining and machine learning strategy.

Study

Extraction Method Opcode ngram

Feature selection TF-IDF

Classifiers used

Conclusion

SVM, LR,RF,ANN, DT,NB and their boosted version BNB and BDT

Recognizing scareware

by Mining Variable Length Instruction Arrangements[4]

Opcode ngram

TF-IDF, CPD

Jrip, SMO, DT, IBk, NB, Random forest

Precise Adware Detection utilizing Opcode Sequence Extraction[6]

Opcode ngram

TF-IDF, CPD

ZeroR ,Naïve Bayes, SMO, IBk, J48, JRip

Assessed number of tests and seen that as setting of 2-gram, TF, utilizing 300 elements chose by DF measure beat. The execution of decision tree & helped decision tree was very well when contrasted with NB & supported NB This paper presents the static analysis strategy in view of information mining which expands the general heuristic detection technique utilizing a variable length instruction grouping digging approach for the motivation behind scareware detection Distinguishes adware utilizing information mining and ML strategy.

KNN also, SVM were compelling at the point when the information was boisterous, KNN's exhibition is unrivaled steadily when new preparation tests are presented, JRip and J48 calculations are costly in term of time utilization to train and produce the model however, it is not difficult to break down the rules and trees created to separate the non-malicious and malicious files.

Recognizing obscure malicious code by applying classification techniques on OpCode designs[3]

©IJRASET: All Rights are Reserved | SJ Impact Factor 7.538 | ISRA Journal Impact Factor 7.894 |

3951

International Journal for Research in Applied Science & Engineering Technology (IJRASET) ISSN: 2321-9653; IC Value: 45.98; SJ Impact Factor: 7.538 Volume 10 Issue V May 2022- Available at www.ijraset.com Detection of Spyware

by Mining Executable Records[5]

Byte sequence, n-gram

CFBE and FBFE

ZeroR, Naïve bayes, SMO, J48, Random forest, JRip

Utilizing Multi-Feature and Classifier Groups to improve Malware Detection[7]

Content (DLL/API function call from PE) and Behavior based feature

Information gain

K-nearest neighbor, Naïve bayes, SVM, decision trees

Data Mining Techniques for Detection of New Malicious Executables[8]

PE, String, Byte Sequence

NA

Ripper, Naïve Bayes, multi naïve bayes

Recognizes spyware by utilizing data mining &ML technique. Include set produced by CFBE choice strategy for the most part created improved results with respect to precision than highlight sets created by FBFE technique.

Worked on the exactness of ML utilizing classifier gathering to supplant individual classifier. Presented ensemble learning algo. Like bagging, supporting, voting and so forth. proposed new ensemble learning technique SVM-AR which beats essentially all well known outfit learning algo.

The most noteworthy exactness and detection pace of multi-naïve bayes algo with 97.76%, over double the signature-based technique

Table II. Comparison of studies papers VI. CONCLUSIONS Internet industry is developing quickly, clients and association need secure and safe exercises over the web. Malware are the greatest danger for the present electronic world as they are unsafe for the clients as they can take their data, ruining information and debilitating the organization and frameworks by malicious assaults. This survey paper presents some existing technologies utilized by security analysts to handle these threats. It makes comparison of static, dynamic and hybrid malware analysis techniques, their comparative review, existing customary malware detection techniques and their benefits and de-merits. As indicated by their comparative review we will utilize advanced malware detection technique for example data mining and machine learning strategy to defeat the disadvantages of existing malware detection techniques.

Because of the limitation of the current malware detection techniques, the machine learning and data mining techniques are joined with existing detection strategies to add the productivity in the detection cycle. Signature based detection strategies are great in recognizing the known malwares however they can't identify unknown malwares and in light of the fact that they can change their marks. signature based detection can likewise not recognize new malware as their mark are not created at this stage. [1]Although heuristic based detection strategies can recognize new, as well as unknown malwares. Different sorts of malware detection technologies are being utilized in industry as per the necessities for instance Host based intrusion detection framework, Network based intrusion detection framework, Hybrid intrusion detection framework, Agent based intrusion detection framework, Web based intrusion detection framework, Application convention based intrusion detection framework and multi-agent P2P intrusion detection framework.

VII. ACKNOWLEDGMENT I would like to express my gratitude to Dr. Dinesh Singh for his support, help and guidance during my research work. He has been a constant guiding force and source of illumination. Finally thank the almighty god with whose grace I am always motivated and deeply engrossed with my work during the entire duration from its conception to success.

REFERENCES [1] [2] [3]

Rabia Tahir,"A Study on Malware and Malware Detection Techniques", International Journal of Education and Management Engineering(IJEME), Vol.8, No.2, pp.20-30, 2018.DOI: 10.5815/ijeme.2018.02.03.

Jyoti landage., jert.org/research/malware-and-malware-detection-techniques-a-survey-IJERTV2IS120163.

Asaf Shabtai, Robert Moskovitch, Clint Feher, Shlomi Dolev and Yuval Elovici, Detecting unknown malicious code by applying classification techniques on OpCode patterns, Security Informatics 2012, 1:1, http://www.securityinformatics.com/content/1/1/1.

©IJRASET: All Rights are Reserved | SJ Impact Factor 7.538 | ISRA Journal Impact Factor 7.894 |

3952

International Journal for Research in Applied Science & Engineering Technology (IJRASET) ISSN: 2321-9653; IC Value: 45.98; SJ Impact Factor: 7.538 Volume 10 Issue V May 2022- Available at www.ijraset.com [4] [5] [6] [7] [8] [9] [10] [11] [12]

R. K. Shahzad and N. Lavesson, Detecting scareware by mining variable length instruction sequences,in Proc. of the 10th Annual Information Security South Africa Conference (ISSA11), Johannesburg, South Africa. IEEE, August 2011, pp. 18.

R. K. Shahzad, S. I. Haider, and N. Lavesson, Detection of spyware by mining executable files, in Proceedings of the 5th International Conference on Availability, Reliability, and Security. IEEE Computer Society, 2010, pp. 295302.

Raja Khurram Shahzad, Niklas Lavesson, Henric Johnson, Accurate Adware Detection using Opcode Sequence Extraction, in Proc. of the 6th International Conference on Availability, Reliability and Security (ARES11),Prague, Czech Republic. IEEE, 2011, pp. 189195.

Yi-Bin Lu, Shu-Chang Din, Chao-Fu Zheng, and Bai-Jian Gao,Using Multi-Feature and Classifier Ensembles to Improve Malware Detection, JOURNAL OF C.C.I.T., VOL.39, NO.2, NOV., 2010.

Matthew G. Schultz, Eleazar Eskin, Erez Zadok, and Salvatore J. Stolfo, Data Mining Methods for Detection of New Malicious Executables, in Proceedings of the Symposium on Security and Privacy, 2001, pp. 3849..

Robiah, Y., et al. "A new generic taxonomy on hybrid malware detection technique." arXiv preprint arXiv: 0909.4860 (2009).

Elhadi, Ammar AE, Mohd A. Maarof, and Ahmed H. Osman. "Malware detection based on hybrid signature behaviour application programming interface call graph." American Journal of Applied Sciences 9.3 (2012): 283.

Bergeron, Jean, et al. "Static detection of malicious code in executable programs." Int. J. of Req. Eng 2001.184-189 (2001): 79.

Rao Heena, “Advances In Malware Detection”, https://arxiv.org/abs/2104.01835

©IJRASET: All Rights are Reserved | SJ Impact Factor 7.538 | ISRA Journal Impact Factor 7.894 |

3953