Generative Adversarial Network Based Real-Time Malware Detection in Cloud Environments

Recently, the rapid growth of cloud computing has created a vast attack surface for malware threats. The existing Support Vector Machine (SVM) accurately detected malwares although the dynamic nature of cloud environments led to high-dimensional data and class imbalance issues. Hence, this research proposes a Generative Adversarial Network (GAN) to address the class imbalance by creating synthetic malware samples. Initially, the input data is collected and fed into the analysis phase with Cuckoo Sandbox to generate malware behavior report in JavaScript Objective Notation (JSON) format. After that, Trend Micro Locality Sensitive Hashing (TLSH) is employed to measure the similarity among files and then the clustering phase groups the similar files as a cluster according to hash values. Further, the features are extracted from JSON format which contains information on Application Programming Interface (API) calls and their return codes. Then, the optimal features are selected using Chi-square to calculate the statistical independence on each feature and finally, GAN model is used to detect malware in cloud environments. From the results, the proposed GAN achieved better results in terms of accuracy (99.61%) when compared to existing Artificial Neural Network (ANN).