2024/09/06 by Anthony J. Rose, Christine M. Schubert Kabban, Scott R. Graham +4 · 13 citations
Computer Science · #Advanced Malware Detection Techniques #Artificial intelligence #Computer science #Malware #Malware analysis #Natural language processing #Network Security and Intrusion Detection #Operating system #Spam and Phishing Detection #Syntax
paper · doi:10.1016/j.cose.2024.104082
published in Computers & Security 148, 104082 (Elsevier BV)
openalex publication_date 2024/09/06 · crossref created 2024/09/06 · crossref issued 2025/01/01 · crossref published 2025/01/01 · crossref published-print 2025/01/01 · crossref deposited 2025/01/24 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/11 · crossref indexed 2026/08/06
The ongoing evolution of malware presents a formidable challenge to cybersecurity: identifying unknown threats. Traditional detection methods, such as signatures and various forms of static analysis , inherently lag behind these evolving threats. This research introduces a novel approach to malware detection by leveraging the robust statistical capabilities of L-moments and the structural insights provided by Abstract Syntax Trees (ASTs) and applying them to PowerShell. L-moments, recognized for their resilience to outliers and adaptability to diverse distributional shapes, are extracted from network analysis measures like degree centrality , betweenness centrality , and closeness centrality of ASTs. These measures provide a detailed structural representation of code, enabling a deeper understanding of its inherent behaviors and patterns. This approach aims to detect not only known malware but also uncover new, previously unidentified threats. A comprehensive comparison with traditional static analysis methods shows that this approach excels in key performance metrics such as accuracy, precision, recall, and F 1 score. These results demonstrate the significant potential of combining L-moments derived from network analysis with ASTs in enhancing malware detection. While static analysis remains an essential tool in cybersecurity, the integration of L-moments and advanced network analysis offers a more effective and efficient response to the dynamic landscape of cyber threats. This study paves the way for future research, particularly in extending the use of L-moments and network analysis into additional areas.