Evaluations of AI‐based malicious PowerShell detection with feature optimizations
| Autor: | Jung-Tae Kim, Jihyeon Song, Sunoh Choi, Ikkyun Kim, Jonghyun Kim |
|---|---|
| Jazyk: | angličtina |
| Rok vydání: | 2021 |
| Předmět: |
General Computer Science
TK7800-8360 business.industry Computer science Deep learning powershell script deep learning feature optimization fileless malware TK5101-6720 Machine learning computer.software_genre Electronic Optical and Magnetic Materials machine learning Feature (computer vision) Telecommunication Artificial intelligence Electrical and Electronic Engineering Electronics business computer |
| Zdroj: | ETRI Journal, Vol 43, Iss 3, Pp 549-560 (2021) |
| ISSN: | 1225-6463 |
| Popis: | Cyberattacks are often difficult to identify with traditional signature‐based detection, because attackers continually find ways to bypass the detection methods. Therefore, researchers have introduced artificial intelligence (AI) technology for cybersecurity analysis to detect malicious PowerShell scripts. In this paper, we propose a feature optimization technique for AI‐based approaches to enhance the accuracy of malicious PowerShell script detection. We statically analyze the PowerShell script and preprocess it with a method based on the tokens and abstract syntax tree (AST) for feature selection. Here, tokens and AST represent the vocabulary and structure of the PowerShell script, respectively. Performance evaluations with optimized features yield detection rates of 98% in both machine learning (ML) and deep learning (DL) experiments. Among them, the ML model with the 3‐gram of selected five tokens and the DL model with experiments based on the AST 3‐gram deliver the best performance. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|
Plný text