.png){kind=icon}
返回
Detecting Malicious .NET Executables Using Extracted Methods Names
.png){kind=icon}
OA
AI
DOI：10.3390/ai6020020.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
The .NET framework is widely used for software development, making it a target for a significant number of malware attacks by developing malicious executables. Previous studies on malware detection often relied on developing generic detection methods for Windows malware that were not tailored to the unique characteristics of .NET executables. As a result, there remains a significant knowledge gap regarding the development of effective detection methods tailored to .NET malware. This work introduces a novel framework for detecting malicious .NET executables using statically extracted method names. To address the lack of datasets focused exclusively on .NET malware, a new dataset consisting of both malicious and benign .NET executable features was created. Our approach involves decompiling .NET executables, parsing the resulting code, and extracting standard .NET method names. Subsequently, feature selection techniques were applied to filter out less relevant method names. The performance of six machine learning models-XGBoost, random forest, K-nearest neighbor (KNN), support vector machine (SVM), logistic regression, and na & iuml;ve Bayes-was compared. The results indicate that XGBoost outperforms the other models, achieving an accuracy of 96.16% and an F1-score of 96.15%. The experimental results show that standard .NET method names are reliable features for detecting .NET malware.
Keyword:
malware analysis
malware detection
windows
static analysis
.NET
machine learning
期刊
A
IF:
5
论文数:
1.0K
被引数:
941
机构
引用论文
Redox behaviour of mixed-ligand five-coordinate cobalt(I) complexes with isocyanides and phosphines
PREAI
分享收藏Roundtable Discussion on Milkfat, Dairy Foods, and Coronary Heart Disease Risk关于乳脂、乳制品和冠心病风险的圆桌讨论
PREAI
分享收藏A comprehensive survey on deep learning based malware detection techniques基于深度学习的恶意软件检测技术综述.png)
COMPUTER SCIENCE REVIEWOAAI
COMPUTER SCIENCE REVIEWIF12.7
OAAI分享收藏
A novel deep framework for dynamic malware detection based on API sequence intrinsic features一种基于API序列内在特征的深度动态恶意软件检测框架COMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
分享收藏
查看更多内容