Alireza Monemi
Universiti Teknologi Malaysia

Published : 2 Documents Claim Missing Document
Claim Missing Document
Check
Articles

Found 2 Documents
Search

Metamorphic Malware Detection Based on Support Vector Machine Classification of Malware Sub-Signatures Ban Mohammed Khammas; Alireza Monemi; Ismahani Ismail; Sulaiman Mohd Nor; M.N. Marsono
TELKOMNIKA (Telecommunication Computing Electronics and Control) Vol 14, No 3: September 2016
Publisher : Universitas Ahmad Dahlan

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.12928/telkomnika.v14i3.3850

Abstract

Achieving accurate and efficient metamorphic malware detection remains a challenge. Metamorphic malware is able to mutate and alter its code structure in each infection, with some vital functionality and codesegment remain unchanged. We exploit these unchanged features for detecting metamorphic malware detection using Support Vector Machine(SVM) classifier. n-gram features are extracted directly from sample malware binaries to avoid disassembly, which are then masked with the extracted Snort signature n-grams. These masked features reduce considerably the number of selected n-gram features. Our method is capable to accurately detect metamorphic malware with ~99 % accuracy and low false positive rate. The proposed method is also superior than commercially available anti-viruses in detecting metamorphicmalware.
Incremental High Throughput Network Traffic Classifier H.R. Loo; Alireza Monemi; Trias Andromeda; M. N. Marsono
Proceeding of the Electrical Engineering Computer Science and Informatics Vol 4: EECSI 2017
Publisher : IAES Indonesia Section

Show Abstract | Download Original | Original Source | Check in Google Scholar | Full PDF (455.888 KB) | DOI: 10.11591/eecsi.v4.988

Abstract

Today’s network traffic are dynamic and fast. Con-ventional network traffic classification based on flow feature and data mining are not able to process traffic efficiently. Hardware based network traffic classifier is needed to be adaptable to dynamic network state and to provide accurate and updated classification at high speed. In this paper, a hardware architecture of online incremental semi-supervised algorithm is proposed. The hardware architecture is designed such that it is suitable to be incorporated in NetFPGA reference switch design. The experimental results on real datasets show that with only 10% of labeled data, the proposed architecture can perform online classification of network traffic at 1Gbps bitrate with 91% average accuracy without loosing any flows.