Obfuscated File-less Malware Threats: Recent Analysis and Detection Approaches Based on Memory Forensics

Malware is one of the biggest Internet threats. Modern cybersecurity defenses have changed the threat landscape, especially malware, from file-based malware to sophisticated and diverse file-less malware that runs without executable files. This paper proposes an enhanced approach that can detect file-less malware families and sub-families, allowing for more effective incident response processes. It uses machine learning algorithms and ensemble soft voting to improve overall predictive accuracy. The impact of this approach is demonstrated, showcasing its potential to improve the detection accuracy of file-less malware and improve the classification of malware into families and subfamilies, which in turn help in mitigation techniques. Malware families and subfamilies are difficult to identify from one another when doing multi-class classification since the characteristics of various malware kinds are frequently very similar. The proposed approach combines bagging, boosting, and soft voting to address the challenge of multi-class classification, achieving a (3.47 to 5.01)% accuracy gain over previous work for malware family and a (5.01 to 10.51)% for malware family classification.