Pre-Lab

Learning Objectives:

• Case study on malware analysis
• Learn and apply support vector machine algorithm to identify malware using dataset having goodware and malware

Malware

Malware, as know as malicious software is a general term that describes any malicious program or code that is harmful to the system.

Malware usually invades, destroys, or disables computers, computer systems, networks, tablets, and mobile devices by controlling part of the device's operations. Like human flu, it interferes with the normal function of the human body.

Malware is making money from you by illegal means. Although malware cannot destroy the physical hardware of a system or network device, it can steal, encrypt or delete your data, change or hijack core computer functions, and monitor your computer activity without your knowledge or permission.

Examples of malware:

Adware: Adware designed to pop up ads on your screen, usually in a web browser. Sometimes these ads can't be closed, or when you click the close button, a new ad site pops up. Often, it uses an illicit method to pretend it's legal, or another program to trick you into installing it on your PC, tablet, or mobile device.

Spyware: Spyware is malicious software that secretly monitors computer users' activities without permission and reports them to the software's author.

Keylogger: Keyloggers are malicious software that records all the letters a user has on a keyboard, usually storing the information and sending it to an attacker who is looking for sensitive information such as user names, passwords or credit card information.

Virus: A virus is malicious software attached to another program. When the program is executed (often unintentionally by the user), it copies itself by modifying other computer programs and infecting them with its own code.

Trojan: A Trojan or Trojan horse is one of the most dangerous types of malware. It usually camouflages itself as something useful to you. Once installed on your system, the attacker behind the Trojan horse can gain unauthorized access to the affected computer. From there, Trojan horses can be used to steal financial information or install threats such as viruses and ransomware.

Support Vector Machine Algorithm

In machine learning, support vector machines (SVMs, also known as support vector networks) are supervised learning models with relevant learning algorithms, which are used to analyze data for classification and regression analysis. Support vector machines (SVMS) are highly preferred by many because they yield high precision with low computational power. Support vector machines (SVM) can be used for regression and classification tasks. However, it is widely used to classify objects.

The goal of support vector machine (SVM) algorithm is to seek a hyperplane in the n-dimensional space (n-characteristic number), and the logarithmic data points of the hyperplane can be clearly classified.

in order to separate these two types of data points, many possible hyperplanes can be selected. Our goal is to find a plane that has the largest margin. the maximum distance between data points of two classes. Maximizing the boundary distance provides some enhancements so that future data points can be classified with more confidence.

A hyperplane is a decision boundary that helps classify logarithmic data points.Data points that fall on either side of the hyperplane can be grouped into different classes.In addition, the size of the hyperplane depends on the number of features.If the number of input features is 2, then the hyperplane is a line.If the input characteristic number is 3, the hyperplane is a two-dimensional plane.When the number of features exceeds 3, it's hard to imagine.

Reference:

• https://www.malwarebytes.com/malware/
• https://towardsdatascience.com/support-vector-machine-introduction-to-machine-learning-algorithms-934a444fca47