PROJECT I
MITIGATING CYBER ATTACKS
21BCI0256
21BCE2215
21BCE2237
ABSTRACT
Zero-day malware detection is crucial due to the evolving nature
of threats that are not identified by traditional signature-based
methods. This study proposes an innovative approach to detect
zero-day malware by combining autoencoding architecture with
one-class (OC) classification. While existing semi-supervised
learning methods have limitations in accuracy and threshold
sensitivity, our proposed method leverages the strengths of both
autoencoders and OC classifiers, achieving up to 97.1% accuracy
on public malware datasets. Additionally, the approach shows
strong resilience against adversarial evasion attacks, maintaining
over 99% detection rates.
OBJECTIVE
The primary objective of this research is to develop an
automated and reliable method for detecting zero-day malware
that overcomes the limitations of existing signature-based and
semi-supervised learning approaches. The proposed method
aims to improve detection accuracy and resilience against
evasion attacks by integrating autoencoding architecture with
one-class classification.
EXISTING SYSYTEM
Current cybersecurity systems primarily focus on perimeter defense
mechanisms, such as firewalls, intrusion detection systems (IDS), and antivirus
software. These systems are designed to prevent unauthorized access and
detect known threats based on signatures or predefined rules. However, they
often fall short when dealing with advanced persistent threats (APTs), zero-day
exploits, and sophisticated attackers who can bypass these defenses.
Current malware detection systems primarily rely on signature-based methods
or supervised learning techniques. These methods are effective in detecting
known malware patterns but struggle with identifying new, previously unseen
threats, commonly referred to as zero-day malware. Semi-supervised learning
approaches, such as profiling-based methods using autoencoders, have been
explored but face challenges related to threshold sensitivity and low detection
rates.
DRAWBACKS OF EXISTING SYSTEM
The existing systems have several drawbacks:
Reactive Nature: Most existing systems are reactive, responding only after an attack has occurred rather than
proactively preventing it.
Limited Threat Detection: Traditional systems rely on known signatures and patterns, making them ineffective against
new and evolving threats.
Lack of Forensic Integration: Current systems often lack integrated forensic capabilities, making it difficult to trace the
origin of attacks and understand the full scope of a breach.
Inadequate Incident Response: Many systems lack automated response mechanisms, leading to delays in mitigating
attacks and minimizing damage.
•Threshold Sensitivity: Profiling-based approaches using autoencoders are sensitive to the threshold setting,
making them less reliable.
•Low Detection Rates: One-class classification methods avoid manual threshold discovery
but suffer from low detection rates, especially when dealing with zero-day malware.
•Limited Scope: These systems primarily focus on known malware patterns, leaving a gap in the detection of
novel threats.
PROPOSED SYSTEM
The proposed system introduces a novel detection method that combines
autoencoding architecture with one-class classification for zero-day malware
detection. Specifically, the system leverages an autoencoder technique for
detecting zero-day vulnerabilities. The objective was to develop an Intrusion
Detection System (IDS) model with a high recall rate and minimal false
negatives. To demonstrate the effectiveness of the model, its results were
compared with those of a one-class Support Vector Machine (SVM). The
study focused on assessing the one-class SVM’s performance when zero-day
attacks deviated from expected behavior. The autoencoder’s encoding–
decoding features proved to be highly beneficial for the proposed IDS model.
The results of the study revealed that this approach not only improves
detection accuracy but also provides strong resilience against adversarial
evasion attacks.
ADVANTAGES
The proposed system offers several advantages:
• Improved Detection Accuracy: Achieves up to 97.1%
accuracy in detecting zero-day malware, comparable to
supervised learning methods.
• Resilience to Evasion Attacks: Demonstrates over 99%
detection rates against malware variants, even when subjected
to adversarial evasion attacks.
• Automated Detection: The system is automated and does
not rely on manual threshold setting, making it more reliable in
dynamic environments.
