Detecting malware evidences through static and dynamic information using extreme machine learning for forensic analysis

Malware forensics is a field in digital forensics that is dedicated to collecting evidence of a malware attack on a system. Malware is also executable code, but unlike regular executables, it is designed to perform unauthorized actions on victim computers. Being an executable, the malware also performs designated tasks through several processes that can leave its traces (digital footprints) throughout different components of the operating system, such as registries, file systems, DLL calls, API calls, memory usage, CPU utilization, network traffic, etc. Some of these traces can exist even after the removal of the malware and can be used as evidence to verify the occurrence of an attack. The proposed malware forensic analysis technique combines both the static and dynamic features of the malware to trace its evidence. This information is collected using the Cuckoo sandbox, which executes the malware sample files in a virtual environment to generate a JSON-formatted analysis report. The Python script is used to extract the non-volatile features from the JSON format analysis report. However, combining both features results in a very long and sparse feature vector, which negatively affects the classifier’s performance. Therefore, the principal component analysis (PCA) algorithm is adopted to reduce the dimensionality of the feature vectors. The generated reduced dimensionality feature vectors are used to train the extreme learning machine (ELM). The ELM can be trained in a fraction of the time compared to the support vector machine (SVM), while achieving similar accuracy. This makes it a favorable choice, especially for malware forensic analysis, where the classifier needs to train with a large amount of data and requires quick decision-making capabilities. The performance of the proposed techniques is evaluated using 90 malicious code samples containing 41 Trojans, 28 worms, and 21 bots. To demonstrate the superiority of the proposed algorithm, a comparison with some state-of-the-art classification methods, named Hidden Markov Model (HMM), Support Vector Machine (SVM), Artificial Neural Network (ANN), and ELM, was also performed. The comparison results show that the proposed technique achieves approximately 11% higher precision, 10% higher recall, and a 10.5% higher F-score than the competitors.