Deep learning detection of packed malware for cloud-based cross domain solutions
Date
2022-12
Authors
Aguilera, Leonardo
Major Professor
Advisor
Jacobson, Doug W
Rursch, Julie
Newman, Jennifer L
Fernandez-Baca, David
Gulmezoglu, Berk
Committee Member
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
Information sharing is a top priority for the Department of Defense (DoD) in support of our warfighters and allies. The amount of shared information has increased exponentially, and there is a strong need for an enterprise cloud that can sustain and support the strategic global DoD operations. However, the existing U.S. Government cloud design does not support enterprise use, and legacy software and hardware applications such as a Cross Domain Solution (CDS) will need to be re-architected, certified, accredited, and authorized for future enterprise cloud use. A CDS is required for sharing and transmitting information between unclassified and classified systems. Unfortunately, suppose the CDS antivirus filter simply matches viruses based on their existing signature. In that case, there is a considerable high risk of data leakage or compromised high-valued systems due to the filter’s inability to detect well-engineered packed malware. Therefore, exploring this CDS antivirus filter problem is important by utilizing more advanced methodologies such as Deep Learning (DL) to identify Windows PE packed malware.
We identified a gap in the literature review. To our knowledge, a DoD enterprise cloud architecture design similar to the one we are proposing does not exist. DL techniques have never been studied before in a CDS antivirus filter.
The contributions of this two-article dissertation are listed below. First, it presents a design for a DoD enterprise cloud architecture. Second, it introduces a new CDS filter model that uses a DL Convolutional Neural Network (CNN) algorithm to detect packed malware. Third, it demonstrates how the CDS filter model performs by testing it in three different computer environments, of which two are cloud-based, and answers the research questions by demonstrating that the model detects packed malware with a 94% validation accuracy and indicates promise with a limited number of Windows PE packed malware binaries.
Series Number
Journal Issue
Is Version Of
Versions
Series
Academic or Administrative Unit
Type
dissertation