Malware Threat Affecting Financial Organization Analysis Using Machine Learning Approach

Malware Threat Affecting Financial Organization Analysis Using Machine Learning Approach

Romil Rawat, Sanjaya Kumar Sarangi, Yagya Nath Rimal, P. William, Snehil Dahima, Sonali Gupta, K. Sakthidasan Sankaran
DOI: 10.4018/IJITWE.304051
Article PDF Download
Open access articles are freely available for download

Abstract

Since 2014, Emotet has been using man-in-the-browsers (MITB) attacks to target companies in the finance industry and their clients. Its key aim is to steal victims' online money-lending records and vital credentials as they go to their banks' websites. Without analyzing network packet payload computing (PPC), IP address labels, port number traces, or protocol knowledge, the authors have used machine learning (ML) modeling to detect Emotet malware infections and recognize Emotet-related congestion flows in this work. To classify Emotet-associated flows and detect Emotet infections, the output outcome values are compared by four separate popular ML algorithms: RF (random forest), MLP (multi-layer perceptron), SMO (sequential minimal optimization technique), and the LRM (logistic regression model). The suggested classifier is then improved by determining the right hyperparameter and attribute set range. Using network packet (computation) identifiers, the random forest classifier detects Emotet-based flows with 99.9726% precision and a 92.3% true positive rating.
Article Preview
Top

Introduction

The number of people using online money lending has increased dramatically in recent years. Because of the growing popularity of online money-lending (Gezer et al., 2019), it has become a target for online deceptive fiscal practices. The amount of malware targeting online device flaws has been gradually increasing in recent years. Cybercriminals employ a variety of tactics to attack online money-lending institutions using fraudulent mails to create malfunctions in users' systems such as phishing emails, key loggers, drive-through downloading, and contaminating targets (victims) with automated and trojanized malware) with the aim of conducting monetary fraud (by botnets, DDOS, data poisoning, and website phishing threats) by capturing user accounts. A monetary botnet is a network of infected computers that can be managed centralised by command and control servers (CCS) in order to target monetary customers. Money-lending Trojans are the most devastating threat to fiscal organisations throughout the world and the key drivers of botnet congestion and malignant activities.

When a customer's computer is corrupted with trojanized malware (Ceschin et al., 2019) (Gramatikakis et al., 2021), it transforms into a zombie that can be tracked and even managed by the risk actor. In general, monetary bots identify the following methods to achieve their objectives:

  • Insert JavaScript (JS) or HTML into the source code-fragment of targeted websites to track congestion to the updated websites.

  • Send the user to a bogus money-lending website that looks just like the real thing.

  • Steal data from bank accounts and fiscal organizations.

  • To gain additional functionality, the API and plugins

Emotet has been behind MITB attacks since 2014 (Daku et al., 2018), targeting companies in the finance industry by inserting malignant code snippets into existing browser sessions. It first gained popularity in April 2014, when a tailored malvertising campaign targeted corporate and company accounts. Its key goal is to harvest online money-lending details from victims' browsers. Emotet shares a lot of code fragments with the Trojan (Dyre) (Azab et al., 2014), a botnet (Daku et al., 2018) used in a variety of spamming attacks, causing multiples of millions of dollars of damage across the world's leading fiscal institutions.

The accurate detection and prevention of irregularities and congestion found in networks to mitigate or prevent malignant amassment is an essential task in network management. Monetary ransomware is difficult to detect, identify, and test in an automatic manner due to its stealthy nature. A well-identified technique for detecting aberrations in network congestion is ML-based categorization. The detection and prevention of network congestion is usually done using signature or behavior-based methods. A typical series of bytes appearing in a binary-code-snippet is used to classify, detect, and analyse classes of malware in signature-based categorization, but this necessitates scanning of packet payloads. If the packet payload computing (PPC) isn't encrypted, the method described above might be a good way to spot malignant congestion. When analysing (Soomro and Hussain, 2019) user-generated data, this methodology often poses privacy issues and necessitates a lot of computing and storage resources.

Complete Article List

Search this Journal:
Reset
Volume 19: 1 Issue (2024)
Volume 18: 1 Issue (2023)
Volume 17: 4 Issues (2022): 1 Released, 3 Forthcoming
Volume 16: 4 Issues (2021)
Volume 15: 4 Issues (2020)
Volume 14: 4 Issues (2019)
Volume 13: 4 Issues (2018)
Volume 12: 4 Issues (2017)
Volume 11: 4 Issues (2016)
Volume 10: 4 Issues (2015)
Volume 9: 4 Issues (2014)
Volume 8: 4 Issues (2013)
Volume 7: 4 Issues (2012)
Volume 6: 4 Issues (2011)
Volume 5: 4 Issues (2010)
Volume 4: 4 Issues (2009)
Volume 3: 4 Issues (2008)
Volume 2: 4 Issues (2007)
Volume 1: 4 Issues (2006)
View Complete Journal Contents Listing