Antivirus applied to Google Chrome's extension malware

Abstract

Background and Objective

Despite the massive use of antivirus on personal computers, malicious applications are on the rise. Nowadays, modern malware uses browser extensions rather than portable files. A three-month study found that Chrome users downloaded malicious extensions 33 million times. Some of these extensions received more than ten million installs. These malicious extensions captured keystrokes, including passwords, and screenshots.

Methods

This work aims to create antivirus software to detect malicious Google Chrome extensions (CRX). Our engine runs the CRX suspicious sample to infect a monitored Windows OS in a controlled environment. In total, our antivirus monitors and considers 1098 actions that the suspicious CRX file can perform when executed. The audited behaviors serve as input neurons for author neural networks. The aim is to recognize the pattern of malicious add-ons and separate them from benign ones. Instead of deep networks, authorial networks are of low computational complexity. Due to the excellent results in different areas, there is a common belief that deep learning can always provide the best results. In fact, this consideration is false. To prove the theory, the author's antivirus uses shallow morphological neural networks.

Results

Author antivirus is both accurate and efficient, based on neural networks. The authorial antivirus can combine high accuracy with reduced learning time. The antivirus achieved a 99.99 % success rate in detecting malware. It distinguished between benign CRX files and malware. Training takes an average of 0.60 s. The researchers investigate different initial conditions, learning functions and antivirus architectures.

Conclusions

Intelligent antiviruses can fix traditional antiviruses' flaws. They rely on a client's prior infection to act against new threats. Unlike this reactive approach, our antivirus detects harmful add-ons before the user triggers them. Unlike most traditional antiviruses, our antivirus works differently. It can detect the malicious intent of a suspicious add-on before the user clicks it. Our antivirus detects malware preventively rather than reactively. Our antivirus, also, is statistically superior to commercial and state-of-the-art antiviruses.