We found a match
Your institution may have access to this item. Find your institution then sign in to continue.
- Title
Next-generation antivirus for JavaScript malware detection based on dynamic features.
- Authors
de Lima, Sidney M. L.; Souza, Danilo M.; Pinheiro, Ricardo P.; Silva, Sthéfano H. M. T.; Lopes, Petrônio G.; de Lima, Rafael D. T.; de Oliveira, Jemerson R.; Monteiro, Thyago de A.; Fernandes, Sérgio M. M.; Albuquerque, Edison de Q.; da Silva, Washington W. A.; dos Santos, Wellington P.
- Abstract
There are many kinds of Exploit Kits, each one being built with several vulnerabilities, but almost all of them are written in JavaScript. So, we created an antivirus, endowed with machine learning, expert in detecting JavaScript malware based on Runtime Behaviors. In our methodology, JavaScript is executed, in a controlled environment. The goal was to investigate suspicious file behavior. Our antivirus, as a whole, dynamically monitors and ponders 7690 suspicious behaviors that the JavaScript file can do in Windows 7. As experiments, the authorial antivirus is compared to antiviruses based on deep as based on shallow networks. Our antivirus achieves an average accuracy of 99.75% in the distinction between benign and malware, accompanied by a training time of 8.92 s. Establishing the relationship between accuracy and training time is essential in information security. Eight (8) new malware are released every second. An antivirus with excessive training time can become obsolete even when released. As our proposed model can overcome the limitations of state-of-the-art, our antivirus combines high accuracy and fast training. In addition, the authorial antivirus is able to detect JavaScript malware, endowed with digital antiforense, such as obfuscates, polymorphic and fileless attacks.
- Subjects
ANTIVIRUS software; JAVASCRIPT programming language; MALWARE; INFORMATION technology security; MACHINE learning; DIGITAL forensics; VIRUS inhibitors
- Publication
Knowledge & Information Systems, 2024, Vol 66, Issue 2, p1337
- ISSN
0219-1377
- Publication type
Article
- DOI
10.1007/s10115-023-01978-4