Automating Malicious Code Detection Through Ml and Behavioral Analysis

Abstract

Malicious programs that intentionally carry out damaging actions are known as malware. Over the past ten years, there has been an observed increase in the creation of malware. Malware's exponential development and sophistication pose a major threat to network and computer security. Malware is becoming a common tool used by hackers and attackers to carry out assaults on computer systems in order to achieve their harmful goals. The primary means of launching a malware assault on computer systems is the internet, which is used to send malicious emails, drive-by downloads of software, and malicious websites. Computer systems are penetrated for a variety of purposes, including financial gain, the theft of private or sensitive information, the creation of bots inside the system, the inaccessibility of services within the system, etc. The effectiveness of the analytic methodologies used to extract discriminative malware characteristics determines the malware detection system's efficacy. The primary goal of this research project was to identify discriminative characteristics that may be malware and utilise that knowledge to identify it with accuracy.

Supervised machine learning techniques have been used to suggest a behavior-based malware detection method. The Cuckoo sandbox was used to execute both the malicious and safe samples in the dynamic analysis environment. When all four machine-learning algorithms were applied concurrently, the empirical data shows that the model identified malware in real-world apps with a higher detection rate. This method works quite well in identifying malware from unidentified families. All things considered, the web-based architecture offers a practical and fast way to identify malware on Android devices, making it a crucial tool in the battle against malware. The goal is to create a system that can automatically determine if a given application or file is malicious or not. This calls for the development of an algorithm or model that can analyse file attributes and differentiate between files that contain malicious code or activity and those that are clean.