Next Generation Antivirus Applied to Jar Malware Detection based on Runtime Behaviors using Neural Networks

摘要

Java vulnerabilities correspond to 91% of all exploits monitored on the world wide web. Then, the present paper aims to create a NGAV (Next Generation Antivirus), endowed with machine learning and artificial intelligence, specialist in Java malwares detection. In the proposed methodology, the suspect Jar file is executed in order to infect, intentionally, Windows 7 audited in a controlled environment. In all, our NGAV monitors and ponders, statistically, 6824 actions that the suspected Jar file can do when executed. Our NGAV achieves an average performance of 95.61% in the distinction between benign and malwares Jar files. Different initial conditions, learning functions and architectures of our NGAV are investigated in order to maximize their accuracy. Then, the limitations of commercial antiviruses can be supplied by NGAVs. Instead of models based on blacklists, our NGAV allows the detection of Jar malwares in a preventive way and not in a reactive manner as modus operandi of Oracle Java's and others commercial antiviruses.