A Malware Detection Framework Based on Forensic and Unsupervised Machine Learning Methodologies

The detection of malware intrusion requires the identification of its signature. However, it is a complex task due to the malware sophisticated ability to evade security mechanisms deployed by cybersecurity practitioners. Evasion is possible due to malware authors changing the malware signature using metamorphism or polymorphism tactics. Currently, it is necessary to formulate a malware detection method focusing on dynamic and automated malware analysis. Malware Indicator of Compromise (IOC) data analysis with machine learning can be used as a technique to obtain the malware signatures. This technical approach is practical as cyber-attacks using malware with new or changed signature are pandemic and remain undetected, therefore, a framework is needed to overcome this situation. Thus, this research proposed a malware detection framework based on forensic and unsupervised machine learning methodologies. The framework is experimented and proven in detecting malware by referring to the signature derived from the analysis. Furthermore, the framework can provide guidelines for cybersecurity practitioners to conduct threat hunting within their IT systems.