Enhanced Fileless Malware Detection Using a Deep Learning Approach

This study addresses the escalating threat of fileless malware, which bypasses traditional cybersecurity measures by operating exclusively in volatile memory, posing a formidable challenge to detection. Through the integration of memory forensics and deep learning, we introduce an innovative method to improve fileless malware detection. Leveraging memory dump analysis, we extract unique characteristics and patterns associated with fileless malware, employing deep learning algorithms tailored for this purpose. The research aims to create a strong detection framework for accurately identifying fileless malware, which is essential for enhancing cybersecurity resilience. Motivated by the urgency to combat evolving cyber threats, our study focuses on developing and validating a dataset derived from memory forensics and applying deep learning algorithms for malware detection. We employ specialized tools such as Magnet RAM Capture and the Volatility Framework to acquire memory dumps and extract relevant features. Fileless malware samples are collected and executed within a controlled environment, with their memory dump features used to build a comprehensive dataset. Deep learning classifiers, including recurrent neural networks (RNNs) and deep neural networks (DNNs), are chosen for binary classification of fileless malware. The DNN model demonstrates exceptional performance, achieving an accuracy of 97.58% with a true positive rate (TPR) of 97.05% and a minimal false positive rate (FPR). This underscores the efficacy of deep learning in accurately detecting fileless malware, particularly in identifying malicious activities rather than relying on file signatures or registry entries. In the evolving threat landscape, deep learning models provide scalability and efficiency in managing large and diverse datasets, making them essential for combating fileless malware.