Malware detection using Kruskal-Wallis statistical analysis and Tanimoto coefficient

Kamarulzaman, Nafisatun Naja (2017) Malware detection using Kruskal-Wallis statistical analysis and Tanimoto coefficient. Project Report. Universiti Teknikal Malaysia Melaka, Melaka, Malaysia. (Submitted)

	Text (24 Pages) Malware detection using Kruskal-Wallis statistical analysis and Tanimoto coefficient.pdf - Submitted Version Download (374kB)
	Text (Full text) Malware detection using Kruskal-Wallis statistical analysis and Tanimoto coefficient.pdf - Submitted Version Restricted to Registered users only Download (1MB)

Abstract

Vulnerabilities have always been a worry for all software developers because of this, the protection of information systems against malicious activities and attacks in networks has been built, and one of them is intrusion detection systems (IDS). In this case, IDS is built to monitor a range of computer systems such as an information system, a network or a cloud computing for signs of intrusion. In order to observe and examine the data for anomalous and non-anomalous behaviours, Anomaly-based detection approach is used because of its ability to detect novel or “zero-day” attacks. Many anomaly detection techniques have been recommended in the literature to overcome this problem. One of them includes a Statistical-based detection that usually applying statistical analysis to examine and determine the behaviours of a subject such as packets or data. The current statistical based detection method have drawback in differentiate the anomalous behaviours more precisely. On the other hand, the lack of further analysis on anomalous behaviours results in high tendencies of wrongly examined malwares data. Thus, some ways are proposed to overcome the problem. First, distinguish the degree of packet behaviour more accurately using statistical base anomaly detection. Second, differentiate the anomalous and non-anomalous packets behaviour more accurately by exploring the Kruskal-Wallis and Tanimoto coefficient approach. Kruskal-Wallis test is used to find and produce accurate result on examining the packet behaviours. There are a few steps to be focused in this research which include data preparation, scoring method that focus on anomaly score, and analysing data that cover standard deviation, mean, Kruskal-Wallis and threshold based detection using Tanimoto Coefficient. This project contributes a better approach on detecting malicious attacks based on packet characteristics and also to propose a technique of statistical analysis using Kruskal-Wallis to differentiate the anomalous and nonanomalous packet behaviour.

Actions (login required)

View Item