Malware Detection and Analysis using Modern Honeypot Allied with Machine Learning: A Performance Evaluation

Cybercriminals are becoming proficient day by day, yet internet security systems are not improving steadily enough to maintain abreast. Despite massive security investments and continued attempts, industry investigations and studies keep highlighting that intricate cybercriminals and offenders are evolving at a higher pace than security researchers can relate to. Malware attacks are the most prevalent and therefore are growing rapidly. Regardless of how effective and sophisticated network security devices such as the firewall, antivirus, and IDS signature-based are, they are thought to be incapable of spotting malware. This occurs because of the malware’s rapid spread and the massive influx of fingerprints. The use of honeypots allied to machine learning is a viable approach for identifying malware. Honeypot has the potential to catch suspicious packages, and machine learning is capable of identifying malware by classifying it into classes. This study proposes a framework using honeypot and machine learning that can be able to gather malware-related data and detect malware as well. In order to put the idea into practice, a modern honey network is deployed to gather malware samples. Random Forest, K-Nearest Neighbor, and Decision Tree algorithms are utilized in order to achieve high accuracy and F1-score as compare to previous ones. The study will probably add significance towards cybersecurity.