Network-Level Behavioral Malware Analysis Model based on Bayesian Network

Signature-based analysis is no longer sufficient to solve polymorphic and stealth nature of malware attacks. Therefore, a behavioral or anomalous analysis will provide a more dynamic approach for the solution. However, recent studies have shown that current behavioral analysis methods at network-level have several issues and been categorized into its common characteristics which are reduced parameters, θ and lack of prior information, p(θ). Therefore, this study aims to determine Feature Selection and Distribution Density model to select optimized features, then to design Predictive Analytics Model based on Bayesian Network to improve the analysis prediction. Finally, the aim is to evaluate detection, accuracy and false alarm rate of the model against the subject matter expert model, SVM, k-NN and Lease Squared using standard and ground-truth dataset of production traffic from the healthcare provider in Malaysia. Results have shown that the proposed model consistently outperformed other models.