2015 Projects

Spyware is a form of malware with the primary intention of stealing information from a victim or monitoring the victim’s online and offline activity. Users may contract spyware through clicking misleading hyperlinks, downloading malicious files, or through an external medium. Anti-malware solutions commonly employ the use of signature-based and heuristic-based detection to detect and remove spyware, which lacks the ability to detect new spyware or mutated traces of existing spyware. The goal of our research is to create a spyware detection solution that will serve three purposes: to appropriately identify and classify unknown files on a spectrum of spyware severity; to introduce a self-adapting structure to detect modified spyware traces; and to increase the accuracy of detection results. Our solution is accomplished through the use of data mining and machine learning concepts and algorithms. We perform two types of data mining on samples, extracting n-grams and Portable Executable structures as features for our machine learning segment. We also introduce a new hybrid learning approach that utilizes both supervised and unsupervised machine learning. A supervised learning algorithm is applied to classify if a file is considered spyware or benign. The files classified as spyware will then be categorized on a severity spectrum using the self-organizing feature map, an unsupervised learning algorithm.