Use of Data Visualisation for Zero-Day Malware Detection

With the explosion of Internet of Things (IoT) worldwide, there is an increasing threat from malicious software (malware) attackers that calls for efficient monitoring of vulnerable systems. Large amounts of data collected from computer networks, servers, and mobile devices need to be analysed for m...

Ausführliche Beschreibung

Gespeichert in:
Bibliographische Detailangaben
Veröffentlicht in:Security and communication networks Jg. 2018; H. 2018; S. 1 - 13
Hauptverfasser: Venkatraman, Sitalakshmi, Alazab, Mamoun
Format: Journal Article
Sprache:Englisch
Veröffentlicht: Cairo, Egypt Hindawi Publishing Corporation 01.01.2018
Hindawi
John Wiley & Sons, Inc
Schlagworte:
ISSN:1939-0114, 1939-0122
Online-Zugang:Volltext
Tags: Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
Abstract With the explosion of Internet of Things (IoT) worldwide, there is an increasing threat from malicious software (malware) attackers that calls for efficient monitoring of vulnerable systems. Large amounts of data collected from computer networks, servers, and mobile devices need to be analysed for malware proliferation. Effective analysis methods are needed to match with the scale and complexity of such a data-intensive environment. In today’s Big Data contexts, visualisation techniques can support malware analysts going through the time-consuming process of analysing suspicious activities thoroughly. This paper takes a step further in contributing to the evolving realm of visualisation techniques used in the information security field. The aim of the paper is twofold: (1) to provide a comprehensive overview of the existing visualisation techniques for detecting suspicious behaviour of systems and (2) to design a novel visualisation using similarity matrix method for establishing malware classification accurately. The prime motivation of our proposal is to identify obfuscated malware using visualisation of the extended x86 IA-32 (opcode) similarity patterns, which are hard to detect with the existing approaches. Our approach uses hybrid models wherein static and dynamic malware analysis techniques are combined effectively along with visualisation of similarity matrices in order to detect and classify zero-day malware efficiently. Overall, the high accuracy of classification achieved with our proposed method can be visually observed since different malware families exhibit significantly dissimilar behaviour patterns.
AbstractList With the explosion of Internet of Things (IoT) worldwide, there is an increasing threat from malicious software (malware) attackers that calls for efficient monitoring of vulnerable systems. Large amounts of data collected from computer networks, servers, and mobile devices need to be analysed for malware proliferation. Effective analysis methods are needed to match with the scale and complexity of such a data-intensive environment. In today’s Big Data contexts, visualisation techniques can support malware analysts going through the time-consuming process of analysing suspicious activities thoroughly. This paper takes a step further in contributing to the evolving realm of visualisation techniques used in the information security field. The aim of the paper is twofold: (1) to provide a comprehensive overview of the existing visualisation techniques for detecting suspicious behaviour of systems and (2) to design a novel visualisation using similarity matrix method for establishing malware classification accurately. The prime motivation of our proposal is to identify obfuscated malware using visualisation of the extended x86 IA-32 (opcode) similarity patterns, which are hard to detect with the existing approaches. Our approach uses hybrid models wherein static and dynamic malware analysis techniques are combined effectively along with visualisation of similarity matrices in order to detect and classify zero-day malware efficiently. Overall, the high accuracy of classification achieved with our proposed method can be visually observed since different malware families exhibit significantly dissimilar behaviour patterns.
With the explosion of Internet of Things (IoT) worldwide, there is an increasing threat from malicious software (malware) attackers that calls for efficient monitoring of vulnerable systems. Large amounts of data collected from computer networks, servers, and mobile devices need to be analysed for malware proliferation. Effective analysis methods are needed to match with the scale and complexity of such a data-intensive environment. In today’s Big Data contexts, visualisation techniques can support malware analysts going through the time-consuming process of analysing suspicious activities thoroughly. This paper takes a step further in contributing to the evolving realm of visualisation techniques used in the information security field. The aim of the paper is twofold: ( 1 ) to provide a comprehensive overview of the existing visualisation techniques for detecting suspicious behaviour of systems and ( 2 ) to design a novel visualisation using similarity matrix method for establishing malware classification accurately. The prime motivation of our proposal is to identify obfuscated malware using visualisation of the extended x86 IA-32 (opcode) similarity patterns, which are hard to detect with the existing approaches. Our approach uses hybrid models wherein static and dynamic malware analysis techniques are combined effectively along with visualisation of similarity matrices in order to detect and classify zero-day malware efficiently. Overall, the high accuracy of classification achieved with our proposed method can be visually observed since different malware families exhibit significantly dissimilar behaviour patterns.
Author Alazab, Mamoun
Venkatraman, Sitalakshmi
Author_xml – sequence: 1
  fullname: Venkatraman, Sitalakshmi
– sequence: 2
  fullname: Alazab, Mamoun
BookMark eNqF0EtLw0AQB_BFKthWb54l4FFj95Vs9iitL6h4qR68hMk-cEvM1t2U0m9vaoqCIJ52YH8zw_xHaND4xiB0SvAVIVk2oZgUEyJowTA7QEMimUwxoXTwXRN-hEYxLjHOCRd8iIrnaBJvkxm0kLy4uIbaRWidbxLrQ_Jqgk9nsE0eod5AMMnMtEbtvo_RoYU6mpP9O0aL25vF9D6dP909TK_nqWI5blPAQhCmi1xraXhuKUhtlbRQYaqoEForLjkmmmtcYdA5NRRXYIVVlWSWjdF5P3YV_MfaxLZc-nVouo0l5VkmCiFy2inaKxV8jMHYUrn264o2gKtLgstdQOUuoHIfUNd0-atpFdw7hO1f_KLnb67RsHH_6bNem84YCz-aEiZxwT4BfX999A
CitedBy_id crossref_primary_10_1007_s00500_021_06492_9
crossref_primary_10_3390_electronics11071044
crossref_primary_10_1016_j_future_2020_02_002
crossref_primary_10_1109_ACCESS_2020_3033883
crossref_primary_10_1155_2021_1070586
crossref_primary_10_1016_j_future_2021_02_008
crossref_primary_10_1016_j_cose_2020_102133
crossref_primary_10_7717_peerj_cs_553
crossref_primary_10_3390_electronics9020274
crossref_primary_10_1016_j_compeleceng_2022_107737
crossref_primary_10_1109_ACCESS_2022_3204171
crossref_primary_10_7717_peerj_cs_504
crossref_primary_10_1109_TNSE_2021_3059881
crossref_primary_10_1109_ACCESS_2021_3090464
crossref_primary_10_1109_ACCESS_2023_3327922
crossref_primary_10_1109_TETC_2022_3170544
crossref_primary_10_1145_3491223
crossref_primary_10_1186_s42400_021_00077_7
crossref_primary_10_1016_j_micpro_2023_104935
crossref_primary_10_1049_ipr2_12222
crossref_primary_10_1016_j_comcom_2021_04_021
crossref_primary_10_1016_j_future_2021_07_015
crossref_primary_10_1155_2021_6652606
crossref_primary_10_3390_s23167084
crossref_primary_10_1007_s11276_020_02529_3
crossref_primary_10_1016_j_jisa_2020_102718
crossref_primary_10_3390_electronics10111241
crossref_primary_10_1007_s00500_023_08737_1
crossref_primary_10_1002_cpe_7691
crossref_primary_10_1007_s00500_023_07906_6
crossref_primary_10_1007_s11042_022_13426_6
crossref_primary_10_1016_j_comcom_2021_05_016
crossref_primary_10_1002_int_22877
crossref_primary_10_1049_iet_ifs_2019_0189
crossref_primary_10_1007_s00500_022_06763_z
crossref_primary_10_1007_s12083_023_01507_8
crossref_primary_10_3390_s21144834
crossref_primary_10_3390_g11040064
crossref_primary_10_1155_2021_5521713
crossref_primary_10_1109_TVT_2021_3074820
crossref_primary_10_1002_dac_5159
crossref_primary_10_1016_j_jisa_2019_06_006
crossref_primary_10_1109_TITS_2021_3066487
crossref_primary_10_3390_app13031484
crossref_primary_10_1109_TC_2020_3015584
crossref_primary_10_1016_j_knosys_2021_107020
crossref_primary_10_1007_s12083_021_01121_6
crossref_primary_10_32604_cmc_2021_016736
crossref_primary_10_3390_app12178482
crossref_primary_10_7717_peerj_cs_525
crossref_primary_10_1155_2020_6724513
crossref_primary_10_1109_ACCESS_2025_3550781
crossref_primary_10_1016_j_inffus_2021_04_017
crossref_primary_10_3390_s22072798
crossref_primary_10_1016_j_comnet_2020_107138
crossref_primary_10_1109_JIOT_2021_3085422
crossref_primary_10_1080_01969722_2022_2068226
crossref_primary_10_1109_ACCESS_2019_2895334
crossref_primary_10_1109_ACCESS_2024_3485706
crossref_primary_10_32604_cmc_2021_016229
crossref_primary_10_1155_2022_1615528
crossref_primary_10_7717_peerj_cs_1319
crossref_primary_10_3390_fi13110273
crossref_primary_10_1109_TITS_2021_3056704
crossref_primary_10_1155_2021_5561816
crossref_primary_10_7717_peerj_cs_579
crossref_primary_10_1155_2021_5579851
crossref_primary_10_1007_s11042_022_13425_7
crossref_primary_10_1016_j_future_2021_03_001
crossref_primary_10_1155_2019_1315047
crossref_primary_10_3390_rs12152358
crossref_primary_10_1016_j_future_2021_03_008
crossref_primary_10_1109_ACCESS_2024_3473289
crossref_primary_10_3390_electronics9091379
Cites_doi 10.1109/TVCG.2011.144
10.1007/s12650-014-0246-x
10.2991/978-94-6239-186-4
10.1109/MCG.2006.31
10.1016/j.jss.2014.10.031
10.1155/2018/7247095
10.1109/TVCG.2014.2388208
10.1186/s13673-018-0125-x
10.1007/978-3-319-47217-1_8
10.1155/2014/132713
10.1108/17440081311316361
10.1155/2017/6451260
10.1109/MCG.2006.49
10.1007/978-3-319-60753-5_19
10.1109/2945.981847
10.1002/sec.1723
10.1016/j.cose.2017.02.003
10.1007/978-3-319-67071-3_33
10.1109/38.974517
10.1109/SURV.2013.102913.00020
10.1007/s10207-014-0242-0
10.1007/s11416-016-0267-1
10.1007/s40012-016-0095-y
10.1145/2089125.2089126
10.1504/IJESDF.2013.055047
10.5121/ijmit.2017.9301
10.1109/ACCESS.2018.2799854
10.4304/jnw.9.11.2878-2891
ContentType Journal Article
Copyright Copyright © 2018 Sitalakshmi Venkatraman and Mamoun Alazab.
Copyright © 2018 Sitalakshmi Venkatraman and Mamoun Alazab. This is an open access article distributed under the Creative Commons Attribution License (the “License”), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited. Notwithstanding the ProQuest Terms and Conditions, you may use this content in accordance with the terms of the License. https://creativecommons.org/licenses/by/4.0
Copyright_xml – notice: Copyright © 2018 Sitalakshmi Venkatraman and Mamoun Alazab.
– notice: Copyright © 2018 Sitalakshmi Venkatraman and Mamoun Alazab. This is an open access article distributed under the Creative Commons Attribution License (the “License”), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited. Notwithstanding the ProQuest Terms and Conditions, you may use this content in accordance with the terms of the License. https://creativecommons.org/licenses/by/4.0
DBID ADJCN
AHFXO
RHU
RHW
RHX
AAYXX
CITATION
7SC
7SP
8FD
JQ2
L7M
L~C
L~D
DOI 10.1155/2018/1728303
DatabaseName الدوريات العلمية والإحصائية - e-Marefa Academic and Statistical Periodicals
معرفة - المحتوى العربي الأكاديمي المتكامل - e-Marefa Academic Complete
Hindawi Publishing Complete
Hindawi Publishing Subscription Journals
Hindawi Publishing Open Access
CrossRef
Computer and Information Systems Abstracts
Electronics & Communications Abstracts
Technology Research Database
ProQuest Computer Science Collection
Advanced Technologies Database with Aerospace
Computer and Information Systems Abstracts – Academic
Computer and Information Systems Abstracts Professional
DatabaseTitle CrossRef
Technology Research Database
Computer and Information Systems Abstracts – Academic
Electronics & Communications Abstracts
ProQuest Computer Science Collection
Computer and Information Systems Abstracts
Advanced Technologies Database with Aerospace
Computer and Information Systems Abstracts Professional
DatabaseTitleList Technology Research Database
CrossRef


Database_xml – sequence: 1
  dbid: RHX
  name: Hindawi Publishing Open Access
  url: http://www.hindawi.com/journals/
  sourceTypes: Publisher
DeliveryMethod fulltext_linktorsrc
Discipline Engineering
EISSN 1939-0122
Editor Yang, Qing
Editor_xml – sequence: 1
  givenname: Qing
  surname: Yang
  fullname: Yang, Qing
EndPage 13
ExternalDocumentID 10_1155_2018_1728303
1213908
GroupedDBID .4S
.DC
05W
0R~
123
24P
31~
3SF
4.4
52U
5DZ
66C
8-1
8UM
AAESR
AAEVG
AAFWJ
AAMMB
AANHP
AAONW
AAZKR
ACBWZ
ACCMX
ACGFO
ACRPL
ACXQS
ACYXJ
ADBBV
ADIZJ
ADJCN
ADMLS
ADNMO
AEFGJ
AEIMD
AENEX
AFBPY
AGQPQ
AGXDD
AHFXO
AIDQK
AIDYY
AJXKR
ALMA_UNASSIGNED_HOLDINGS
AMBMR
ARCSS
ASPBG
ATUGU
AVWKF
AZFZN
AZVAB
BCNDV
BDRZF
BHBCM
BNHUX
BOGZA
BRXPI
CS3
DR2
DU5
EBS
EIS
EJD
F1Z
FEDTE
G-S
GODZA
H13
HVGLF
HZ~
IX1
LH4
LITHE
LW6
MY.
MY~
NNB
O9-
OIG
OK1
P2P
PUEGO
ROL
SUPJJ
TH9
TUS
W99
WBKPD
XV2
1OC
AAJEY
AFKRA
ARAPS
BENPR
BGLVJ
CCPQU
GROUPED_DOAJ
HCIFZ
IAO
ICD
ITC
K7-
PIMPY
RHU
RHW
RHX
AAYXX
ALUQN
CITATION
7SC
7SP
8FD
JQ2
L7M
L~C
L~D
ID FETCH-LOGICAL-c360t-a07713d86dd9e46f2a9dfc9fab02c277ddc49401d4d0b0ad62e20baf7fcb93f3
IEDL.DBID RHX
ISICitedReferencesCount 92
ISICitedReferencesURI http://www.webofscience.com/api/gateway?GWVersion=2&SrcApp=Summon&SrcAuth=ProQuest&DestLinkType=CitingArticles&DestApp=WOS_CPL&KeyUT=000453813700001&url=https%3A%2F%2Fcvtisr.summon.serialssolutions.com%2F%23%21%2Fsearch%3Fho%3Df%26include.ft.matches%3Dt%26l%3Dnull%26q%3D
ISSN 1939-0114
IngestDate Sun Jul 13 05:28:28 EDT 2025
Tue Nov 18 22:32:11 EST 2025
Sat Nov 29 02:59:30 EST 2025
Sun Jun 02 18:54:26 EDT 2024
Thu Sep 25 15:24:50 EDT 2025
IsDoiOpenAccess true
IsOpenAccess true
IsPeerReviewed true
IsScholarly true
Issue 2018
Language English
License This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
http://creativecommons.org/licenses/by/4.0
LinkModel DirectLink
MergedId FETCHMERGED-LOGICAL-c360t-a07713d86dd9e46f2a9dfc9fab02c277ddc49401d4d0b0ad62e20baf7fcb93f3
Notes ObjectType-Article-1
SourceType-Scholarly Journals-1
ObjectType-Feature-2
content type line 14
ORCID 0000-0002-1928-3704
0000-0002-2772-133X
OpenAccessLink https://dx.doi.org/10.1155/2018/1728303
PQID 2455787762
PQPubID 1046363
PageCount 13
ParticipantIDs proquest_journals_2455787762
crossref_citationtrail_10_1155_2018_1728303
crossref_primary_10_1155_2018_1728303
hindawi_primary_10_1155_2018_1728303
emarefa_primary_1213908
PublicationCentury 2000
PublicationDate 2018-01-01
PublicationDateYYYYMMDD 2018-01-01
PublicationDate_xml – month: 01
  year: 2018
  text: 2018-01-01
  day: 01
PublicationDecade 2010
PublicationPlace Cairo, Egypt
PublicationPlace_xml – name: Cairo, Egypt
– name: London
PublicationTitle Security and communication networks
PublicationYear 2018
Publisher Hindawi Publishing Corporation
Hindawi
John Wiley & Sons, Inc
Publisher_xml – name: Hindawi Publishing Corporation
– name: Hindawi
– name: John Wiley & Sons, Inc
References 44
23
24
25
47
26
(35) 2017
(39) 2009
(11) 2006
(31) 2014
(37) 2017
(38) 2007
50
30
10
54
55
34
56
13
14
58
16
(62) 2017
(2) 2017
(1) 2006
5
(40) 2014
7
8
9
60
(27) 2006
61
(33) 2015
41
63
20
21
(32) 2017; 60
43
References_xml – ident: 30
  doi: 10.1109/TVCG.2011.144
– ident: 24
  doi: 10.1007/s12650-014-0246-x
– ident: 25
  doi: 10.2991/978-94-6239-186-4
– year: 2006
  ident: 11
– ident: 43
  doi: 10.1109/MCG.2006.31
– ident: 20
  doi: 10.1016/j.jss.2014.10.031
– ident: 55
  doi: 10.1155/2018/7247095
– year: 2009
  ident: 39
– ident: 56
  doi: 10.1109/TVCG.2014.2388208
– ident: 16
  doi: 10.1186/s13673-018-0125-x
– ident: 13
  doi: 10.1007/978-3-319-47217-1_8
– ident: 50
  doi: 10.1155/2014/132713
– ident: 58
  doi: 10.1108/17440081311316361
– ident: 54
  doi: 10.1155/2017/6451260
– ident: 34
  doi: 10.1109/MCG.2006.49
– year: 2007
  ident: 38
– ident: 44
  doi: 10.1007/978-3-319-60753-5_19
– year: 2006
  ident: 27
– ident: 26
  doi: 10.1109/2945.981847
– ident: 60
  doi: 10.1002/sec.1723
– volume: 60
  issue: 12
  year: 2017
  ident: 32
  publication-title: Scince China Information Sciences
– start-page: 139
  volume-title: Visual Analytics: Foundations and Experiences in Malware Analysis
  year: 2017
  ident: 35
– ident: 63
  doi: 10.1016/j.cose.2017.02.003
– year: 2015
  ident: 33
– year: 2014
  ident: 31
– volume-title: Computer Viruses and Malware
  year: 2006
  ident: 1
– year: 2017
  ident: 2
  publication-title: System American Journal of Applied Sciences
– ident: 14
  doi: 10.1007/978-3-319-67071-3_33
– ident: 41
  doi: 10.1109/38.974517
– ident: 23
  doi: 10.1109/SURV.2013.102913.00020
– ident: 47
  doi: 10.1007/s10207-014-0242-0
– ident: 7
  doi: 10.1007/s11416-016-0267-1
– ident: 10
  doi: 10.1007/s40012-016-0095-y
– year: 2017
  ident: 37
– ident: 5
  doi: 10.1145/2089125.2089126
– year: 2017
  ident: 62
  publication-title: Computers & Security
– ident: 9
  doi: 10.1504/IJESDF.2013.055047
– ident: 21
  doi: 10.5121/ijmit.2017.9301
– ident: 61
  doi: 10.1109/ACCESS.2018.2799854
– volume-title: Data-driven security analysis, visualisation, and dashboards
  year: 2014
  ident: 40
– ident: 8
  doi: 10.4304/jnw.9.11.2878-2891
SSID ssj0061474
Score 2.4591324
Snippet With the explosion of Internet of Things (IoT) worldwide, there is an increasing threat from malicious software (malware) attackers that calls for efficient...
SourceID proquest
crossref
hindawi
emarefa
SourceType Aggregation Database
Enrichment Source
Index Database
Publisher
StartPage 1
SubjectTerms Application programming interface
Automation
Big Data
Classification
Computer networks
Computer viruses
Computers
Criminal investigations
Cybersecurity
Data analysis
Data encryption
Data mining
Electronic devices
Internet of Things
Machine learning
Malware
Network security
Reverse engineering
Scientific visualization
Similarity
Similarity measures
Subject specialists
Support vector machines
Visualization
Wireless networks
Title Use of Data Visualisation for Zero-Day Malware Detection
URI https://search.emarefa.net/detail/BIM-1213908
https://dx.doi.org/10.1155/2018/1728303
https://www.proquest.com/docview/2455787762
Volume 2018
WOSCitedRecordID wos000453813700001&url=https%3A%2F%2Fcvtisr.summon.serialssolutions.com%2F%23%21%2Fsearch%3Fho%3Df%26include.ft.matches%3Dt%26l%3Dnull%26q%3D
hasFullText 1
inHoldings 1
isFullTextHit
isPrint
journalDatabaseRights – providerCode: PRVWIB
  databaseName: Wiley Online Library Open Access
  customDbUrl:
  eissn: 1939-0122
  dateEnd: 99991231
  omitProxy: false
  ssIdentifier: ssj0061474
  issn: 1939-0114
  databaseCode: 24P
  dateStart: 20170101
  isFulltext: true
  titleUrlDefault: https://authorservices.wiley.com/open-science/open-access/browse-journals.html
  providerName: Wiley-Blackwell
link http://cvtisr.summon.serialssolutions.com/2.0.0/link/0/eLvHCXMwjV1LS8NAEF5ssaAH8W21lj3UkwTTzSabHMVaerEUqVK8hMk-sFBTaaLFf-9usvFVRG8JTDbw7Wa-mezsNwh1hCelT4R0EhZyR_Ot5wBw5kQBV75SkkovKZpNsOEwnEyikRVJyla38DXb6fS8G16YNkqeUfWshb5ZvLeDSeVwNcEwu3lsSn-6tKpv__HsN-ZpyCfQF5qOGo8m-V1OV5xxwTD9bbRlQ0N8Wc7lDlqT6S7a_CIYuIfCu0ziucI9yAHfTzNzIrIsx8E6-MQPcjF3evCGb2C21C_GPZkXpVbpPhr3r8dXA8f2PnC4F7i5Ay7T6aMIAyEiSQNFIBKKRwoSl3DCmBCcRjo3ElS4iQsiIJK4CSimeBJ5yjtA9XSeyiOEOXSB6yABopBRQQGU6HIQZbNQ5fEmOq9gibnVBTftKWZxkR_4fmxAjC2ITXT2Yf1c6mH8YndoEf40IzradMMm6ljE_xigVU1HbD-rLCbUNx5GO_Dj_41ygjbMbfnPpIXq-eJFnqJ1_ppPs0Ub1QgdtYvF9A5d1b-s
linkProvider Hindawi Publishing
openUrl ctx_ver=Z39.88-2004&ctx_enc=info%3Aofi%2Fenc%3AUTF-8&rfr_id=info%3Asid%2Fsummon.serialssolutions.com&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.atitle=Use+of+Data+Visualisation+for+Zero-Day+Malware+Detection&rft.jtitle=Security+and+communication+networks&rft.au=Venkatraman%2C+Sitalakshmi&rft.au=Alazab%2C+Mamoun&rft.date=2018-01-01&rft.pub=John+Wiley+%26+Sons%2C+Inc&rft.issn=1939-0114&rft.eissn=1939-0122&rft.volume=2018&rft_id=info:doi/10.1155%2F2018%2F1728303&rft.externalDBID=NO_FULL_TEXT
thumbnail_l http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/lc.gif&issn=1939-0114&client=summon
thumbnail_m http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/mc.gif&issn=1939-0114&client=summon
thumbnail_s http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/sc.gif&issn=1939-0114&client=summon