Enhanced Fileless Malware Detection Using a Deep Learning Approach

Abstract

This study addresses the escalating threat of fileless malware, which bypasses traditional cybersecurity measures by operating exclusively in volatile memory, posing a formidable challenge to detection. Through the integration of memory forensics and deep learning, we introduce an innovative method to improve fileless malware detection. Leveraging memory dump analysis, we extract unique characteristics and patterns associated with fileless malware, employing deep learning algorithms tailored for this purpose. The research aims to create a strong detection framework for accurately identifying fileless malware, which is essential for enhancing cybersecurity resilience. Motivated by the urgency to combat evolving cyber threats, our study focuses on developing and validating a dataset derived from memory forensics and applying deep learning algorithms for malware detection. We employ specialized tools such as Magnet RAM Capture and the Volatility Framework to acquire memory dumps and extract relevant features. Fileless malware samples are collected and executed within a controlled environment, with their memory dump features used to build a comprehensive dataset. Deep learning classifiers, including recurrent neural networks (RNNs) and deep neural networks (DNNs), are chosen for binary classification of fileless malware. The DNN model demonstrates exceptional performance, achieving an accuracy of 97.58% with a true positive rate (TPR) of 97.05% and a minimal false positive rate (FPR). This underscores the efficacy of deep learning in accurately detecting fileless malware, particularly in identifying malicious activities rather than relying on file signatures or registry entries. In the evolving threat landscape, deep learning models provide scalability and efficiency in managing large and diverse datasets, making them essential for combating fileless malware.

Country : India

1 Seema B Joshi2 Rohita Regunathan Warrier

  1. Gujarat Technological University, Ahmedabad, 382424, Gujarat, India
  2. ME - Cybersecurity (Batch-2022-24) PG Scholar, Gujarat Technological University, Ahmedabad, 382424, Gujarat, India

IRJIET, Volume 9, Issue 3, March 2025 pp. 221-227

doi.org/10.47001/IRJIET/2025.903029

References

  1. Khalid O, Ullah S, Ahmad T, Saeed S, Alabbad DA, Aslam M, et al. An insight into the machine-learning-based fileless malware detection. Sensors (Basel) [Internet]. 2023;23(2). Available from: http://dx.doi.org/10.3390/s23020612.
  2. Usman N, Usman S, Khan F, Jan MA, Sajid A, Alazab M, et al. Intelligent, dynamic malware detection using machine learning in IP reputation for forensic data analytics. Future Generation Computer Systems. 2021; 118:124–41.
  3. Shah SSH, Ahmad AR, Jamil N, Khan A ur R. Memory forensics-based malware detection using computer vision and Machine Learning. Electronics (Basel) [Internet]. 2022;11(16):2579. Available from: http://dx.doi.org/10.3390/electronics11162579.
  4. Bozkir AS, Tahillioglu E, Aydos M, Kara I. Catch them alive. A malware detection approach through memory forensics, manifold learning, and computer vision. Computers & Security. 2021;103.
  5. Zhang S, Hu C, Wang L, Mihaljevic MJ, Xu S, Lan T. A Malware Detection Approach Based on Deep Learning and Memory Forensics. Symmetry. 2023;15(3).
  6. Ayad A, Farag HEZ, Youssef A, El-Saadany EF. Detection of false data injection attacks in smart grids using Recurrent Neural Networks. In: 2018 IEEE Power & Energy Society Innovative Smart Grid Technologies Conference (ISGT). IEEE; 2018.
  7. Liu J-D, Ou Y-Y. An improved XSS vulnerability detection method based on attack vector. DEStech Trans Comput Sci Eng [Internet]. 2018;(icmsa). Available from: http://dx.doi.org/10.12783/dtcse/icmsa2018/23251.
  8. Ahmadi A, Nabipour M, Taheri S, Mohammadi-Ivatloo B, Vahidinasab V. A new false data injection attack detection model for cyberattack resilient energy forecasting. IEEE Trans Industr Inform [Internet]. 2023;19(1):371–81. Available from: http://dx.doi.org/10.1109/tii.2022.3151748.
  9. Pei C, Xiao Y, Liang W, Han X. PMU placement protection against coordinated false data injection attacks in smart grid. IEEE Trans Ind Appl [Internet]. 2020;56(2):1–1. Available from: https://yangxiao.cs.ua.edu/PMU_Placement_Protection_Against_Coordinated_False_Data_Injection_Attacks_in_Smart_Grid.pdf
  10. Huang K, Xiang Z, Deng W, Yang C, Wang Z. False data injection attacks detection in smart grid: A structural sparse matrix separation method. IEEE Trans Netw Sci Eng [Internet]. 2021;8(3):2545–58. Available from: http://dx.doi.org/10.1109/tnse.2021.3098738.
  11. Roy P, Kumar R, Rani P. SQL injection attack detection by machine learning classifier. In: 2022 International Conference on Applied Artificial Intelligence and Computing (ICAAIC). IEEE; 2022.
  12. Singh SK, Khanna K, Bose R, Panigrahi BK, Joshi A. Joint-transformation-based detection of false data injection attacks in smart grid. IEEE Trans Industr Inform [Internet]. 2018;14(1):89–97. Available from: http://dx.doi.org/10.1109/tii.2017.2720726.
  13. Tripathy D, Gohil R, Halabi T. Detecting SQL injection attacks in cloud SaaS using machine learning. In: 2020 IEEE 6th Intl Conference on Big Data Security on Cloud (BigDataSecurity), IEEE Intl Conference on High Performance and Smart Computing, (HPSC) and IEEE Intl Conference on Intelligent Data and Security (IDS). IEEE; 2020.
  14. Ojagbule O, Wimmer H, Haddad RJ. Vulnerability analysis of content management systems to SQL injection using SQLMAP. In: SoutheastCon 2018. IEEE; 2018.
  15. Scott D, Sharp R. Abstracting application-level web security. In: Proceedings of the 11th international conference on World Wide Web. New York, NY, USA: ACM; 2002.