A New Generic Taxonomy on Hybrid Malware Detection Technique

TL;DR

This paper proposes a new generic taxonomy called Hybrid Malware Detection Technique (Hybrid MDT) that combines signature, specification, and anomaly detection methods to enhance malware detection in Intrusion Detection Systems.

Contribution

It introduces a novel hybrid taxonomy for malware detection that addresses limitations of existing techniques in detecting both known and unknown attacks.

Findings

Hybrid MDT improves detection of known and unknown malware.

Reduces false alerts during intrusion detection.

Enhances overall malware detection effectiveness.

Abstract

Malware is a type of malicious program that replicate from host machine and propagate through network. It has been considered as one type of computer attack and intrusion that can do a variety of malicious activity on a computer. This paper addresses the current trend of malware detection techniques and identifies the significant criteria in each technique to improve malware detection in Intrusion Detection System (IDS). Several existing techniques are analyzing from 48 various researches and the capability criteria of malware detection technique have been reviewed. From the analysis, a new generic taxonomy of malware detection technique have been proposed named Hybrid Malware Detection Technique (Hybrid MDT) which consists of Hybrid Signature and Anomaly detection technique and Hybrid Specification based and Anomaly detection technique to complement the weaknesses of the existing malware detection technique in detecting known and unknown attack as well as reducing false alert before and during the intrusion occur.