C5 MS Word Template Accessible - ricardocalix.com€¦ · Web viewMachine learning cybersecurity ....

8
MACHINE LEARNING CYBERSECURITY FILE-LESS MALWARE ANALYSIS LAB 2: WRITING A CLASSIFIER FOR FILE-LESS MALWARE Lab Description: This lab is to classify the records of activities to predict if they belong to good ware or file-less malware. The dataset contains 142 instances (92 instances are malware and 50 instances are non-malware) with 1000 features. Page | 1 This document is licensed with a Creative Commons Attribution 4.0 International License ©2017 Catalyzing Computing and Cybersecurity in Community Colleges (C5).

Transcript of C5 MS Word Template Accessible - ricardocalix.com€¦ · Web viewMachine learning cybersecurity ....

Page 1: C5 MS Word Template Accessible - ricardocalix.com€¦ · Web viewMachine learning cybersecurity . File-less malware analysis. LAB 2: Writing a cLAssifier for file-less malware. Lab

MACHINE LEARNING CYBERSECURITY FILE-LESS MALWARE ANALYSIS

LAB 2: WRITING A CLASSIFIER FOR FILE-LESS MALWARE

Lab Description: This lab is to classify the records of activities to predict if they belong to good ware or file-less malware.

The dataset contains 142 instances (92 instances are malware and 50 instances are non-malware) with 1000 features.

Page | 1

This document is licensed with a Creative Commons Attribution 4.0 International License ©2017 Catalyzing Computing and Cybersecurity in Community Colleges (C5).

http://www.c5colleges.org/
http://www.c5colleges.org/
https://creativecommons.org/licenses/by/4.0/
Page 2: C5 MS Word Template Accessible - ricardocalix.com€¦ · Web viewMachine learning cybersecurity . File-less malware analysis. LAB 2: Writing a cLAssifier for file-less malware. Lab

The features and class values are both parsed from the log files. Tasks:

o Use WEKA to input the dataset and perform the classificationo Write a python script based on the sklearn library to implement

the classifierso Write a python script based on Tensorflow framework to

implement the classifier.

Lab Environment: The students should have access to a machine with Linux system or

Windows system WEKA should be installed The environment for python is required as well as some packages

such as numpy, tensorflow and sklearn.

Lab Files that are Needed: For this lab you will need only one file (file_less.csv) for both WEKA

and python scripts. The first column is the class value, others are the features.

LAB EXERCISE 1 Import data into WEKA (explorer), the files of type should be specified (csv).

Page | 2

This document is licensed with a Creative Commons Attribution 4.0 International License ©2017 Catalyzing Computing and Cybersecurity in Community Colleges (C5).

http://www.c5colleges.org/
http://www.c5colleges.org/
https://creativecommons.org/licenses/by/4.0/
Page 3: C5 MS Word Template Accessible - ricardocalix.com€¦ · Web viewMachine learning cybersecurity . File-less malware analysis. LAB 2: Writing a cLAssifier for file-less malware. Lab

Choose a proper classifier, such as RandomForest

Specify the test option and the column of class

LAB EXERCISE 2 In this exercise, you need to implement several classifiers with the use

of sklearn. Import sklearn code and required libraries

Page | 3

This document is licensed with a Creative Commons Attribution 4.0 International License ©2017 Catalyzing Computing and Cybersecurity in Community Colleges (C5).

http://www.c5colleges.org/
http://www.c5colleges.org/
https://creativecommons.org/licenses/by/4.0/
Page 4: C5 MS Word Template Accessible - ricardocalix.com€¦ · Web viewMachine learning cybersecurity . File-less malware analysis. LAB 2: Writing a cLAssifier for file-less malware. Lab

Read the features and class values from malware dataset with proper method

file_less.csv is the name of the file. delimiter indicates the character to split the data in a row. usecols indicates which columns will be read. For features, the

columns from 2 to 1000 will be read. For class values, the first columns of the rows will be read.

dtype indicates the type of data to read Since the first line of the file is names for each column, we set

skip_header to 1 to avoid read the first row. Split the dataset. When you finish the preprocess step, you can write the

python script with the use of sklearn package to build your architecture of classifier.

random_state is the seed used by the random number generator This is for the decision tree:

Please print the statistics metrics such as accuracy, recall, precision and f1 score.

Implement the classifiers based on Logistic Regression, Decision Tree, Naïve Bayes and Random Forest

LAB EXERCISE 3 Use the same data you use in the exercise 1 and 2.

Page | 4

This document is licensed with a Creative Commons Attribution 4.0 International License ©2017 Catalyzing Computing and Cybersecurity in Community Colleges (C5).

http://www.c5colleges.org/
http://www.c5colleges.org/
https://creativecommons.org/licenses/by/4.0/
Page 5: C5 MS Word Template Accessible - ricardocalix.com€¦ · Web viewMachine learning cybersecurity . File-less malware analysis. LAB 2: Writing a cLAssifier for file-less malware. Lab

In this exercise, you will implement an artificial neural network classifier based on Tensorflow

Import the required libraries

Repeat the same steps to preprocess the data as Exercise 2. Read the data, standard scale the feature and encode the labels.

Define the learning rate and number of epochs for artificial neural network

An extra step in preprocess is to perform the one-hot encoding for the labels.

Split the dataset after preprocessing and define the parameters to store the shape of placeholder.

Page | 5

This document is licensed with a Creative Commons Attribution 4.0 International License ©2017 Catalyzing Computing and Cybersecurity in Community Colleges (C5).

http://www.c5colleges.org/
http://www.c5colleges.org/
https://creativecommons.org/licenses/by/4.0/
Page 6: C5 MS Word Template Accessible - ricardocalix.com€¦ · Web viewMachine learning cybersecurity . File-less malware analysis. LAB 2: Writing a cLAssifier for file-less malware. Lab

Define the function to draw the plot of performance

Define your own architecture of neural network

Page | 6

This document is licensed with a Creative Commons Attribution 4.0 International License ©2017 Catalyzing Computing and Cybersecurity in Community Colleges (C5).

http://www.c5colleges.org/
http://www.c5colleges.org/
https://creativecommons.org/licenses/by/4.0/
Page 7: C5 MS Word Template Accessible - ricardocalix.com€¦ · Web viewMachine learning cybersecurity . File-less malware analysis. LAB 2: Writing a cLAssifier for file-less malware. Lab

Please print the statistics metrics such as accuracy, recall, precision and f1 score.

Page | 7

This document is licensed with a Creative Commons Attribution 4.0 International License ©2017 Catalyzing Computing and Cybersecurity in Community Colleges (C5).

http://www.c5colleges.org/
http://www.c5colleges.org/
https://creativecommons.org/licenses/by/4.0/
Page 8: C5 MS Word Template Accessible - ricardocalix.com€¦ · Web viewMachine learning cybersecurity . File-less malware analysis. LAB 2: Writing a cLAssifier for file-less malware. Lab

Initialize the variables and placeholders. Then perform the training and testing on iris dataset.

WHAT TO SUBMIT

You should submit a lab report file which include: The steps you preprocessed data The necessary code snippet of your classifier and architecture. The screenshot for both your code snippet and the result are needed. You can call your file "Lab2_Malware_yourname.doc".

Page | 8

This document is licensed with a Creative Commons Attribution 4.0 International License ©2017 Catalyzing Computing and Cybersecurity in Community Colleges (C5).

http://www.c5colleges.org/
http://www.c5colleges.org/
https://creativecommons.org/licenses/by/4.0/

Reversing & malware analysis training part 8 malware memory forensics

Reversing & malware analysis training part 8 malware memory forensics

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network.

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network.

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Using optimization algorithms for malware deobfuscationsigurnost.zemris.fer.hr/ns/malware/2010_spasojevic/Diplomski_Spasojevic.pdf · Using optimization algorithms for malware deobfuscation

Using optimization algorithms for malware deobfuscationsigurnost.zemris.fer.hr/ns/malware/2010_spasojevic/Diplomski_Spasojevic.pdf · Using optimization algorithms for malware deobfuscation

Evaluating Open Source Malware Sandboxes with Linux malware

Evaluating Open Source Malware Sandboxes with Linux malware

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

C5 MS Word Template Accessible · Web viewMachine learning cybersecurity File-less malware analysis LAB 2: Writing a cLAssifier for file-less malware Lab Description: This lab is

C5 MS Word Template Accessible · Web viewMachine learning cybersecurity File-less malware analysis LAB 2: Writing a cLAssifier for file-less malware Lab Description: This lab is

Advanced malware analysis training session6 malware sandbox analysis

Advanced malware analysis training session6 malware sandbox analysis

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Advanced Malware Analysis Training Session 6 - Malware Sandbox Analysis

Advanced Malware Analysis Training Session 6 - Malware Sandbox Analysis

Windows Malware Firewall: Remove Windows Malware Firewall

Windows Malware Firewall: Remove Windows Malware Firewall

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab.

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab.

Malware and Anti-Malware Seminar by Benny Czarny

Malware and Anti-Malware Seminar by Benny Czarny

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection