Malware Detection Using Honeypot and Machine Learning

Malware is one of the threats to information security that continues to increase. In 2014 nearly six million new malware was recorded. The highest number of malware is in Trojan Horse malware while in Adware malware is the most significantly increased malware. Security system devices such as antivirus, firewall, and IDS signature-based are considered to fail to detect malware. This happens because of the very fast spread of computer malware and the increasing number of signatures. Besides signature-based security systems it is difficult to identify new methods, viruses or worms used by attackers. One other alternative in detecting malware is to use honeypot with machine learning. Honeypot can be used as a trap for packages that are suspected while machine learning can detect malware by classifying classes. Decision Tree and Support Vector Machine (SVM) are used as classification algorithms. In this paper, we propose architectural design as a solution to detect malware. We presented the architectural proposal and explained the experimental method to be used.

I. Introduction

According to data released by GData, the number of malware continues to increase. In the second half of 2014 there were 4,150,068 new types of malware. This number increased by almost 2.3 times from the first semester of the same year which amounted to 1,848,617 types of malware. So that overall the recorded malware in 2014 was 5,998,685. based on the category, the highest number of malware is in Trojan Horse malware while in Adware malware is the most significantly increased malware [1].