A Machine Learning Approach for Detecting Obfuscated Malware on Enterprise Network Endpoints

Abstract

Perimeter security ensures users are verified once, after which they would have access to all the resources residing on a network. This made networks vulnerable to advanced persistent threat (APT), the intention, often, is data exfiltration, leading to losses for the enterprise that is the victim of such attacks. Modern enterprise network endpoints could be vulnerable to advanced persistent threat (APT) if a user identity is compromised via theft or social engineering. The enterprise accessed via that compromised endpoint would become vulnerable to the advanced persistent threat (APT) exploit, leading to lateral movement within that network. This praxis aims to develop a multi-class predictive intrusion detection model for categorizing attacks in modern enterprise endpoints. The methodology involves utilizing the CIC-MalMem2022 intrusion dataset, a balanced dataset of 50% benign memory dumps, and the remaining 50 % is made up of malicious dumps. The malicious dumps consist of Trojan Horse, spyware, and ransomware. The intrusion detection model will be obtained by running the above dataset (CIC-MalMem2022) through the following neural network (NN) algorithms: artificial neural network (ANN) and deep neural network (DNN). These NN algorithms are then ensembled with machine learning algorithms such as LightGBM and XGBoost to improve accuracy figures and to handle overfitting. The outcome will be an inclusive multi-intrusion detection model designed for secure access at modern enterprise endpoints.