Enhanced Malware Detection Using Grey Wolf Optimization and Deep Belief Neural Networks

International Journal for ISSN: 2522-3429 (Print)

Electronic Crime Investigation ISSN: 2616-6003 (Online)

DOI: https://doi.org/10.54692/ijeci.2024.0803206

Research Article Vol. 8 issue 3 Jul-Sep 2024

Enhanced Malware Detection Using Grey Wolf Optimization and

Deep Belief Neural Networks

Zohaib Ahmad1, Obaidullah2, Muhammad Ammar Ashraf 3 and Muhammad

Tufail4

1
Faculty of Electronics and Information Engineering, Beijing University of
Technology, Beijing, China.
2
Department of Computer Science, University of Alabama at Birmingham AL 35205,
USA.
3
Department of Computer Science, Ripah international University, Sahiwal Campus,
Sahiwal, Pakistan
4
Department of Computer Science, Government Postgraduate College, Nowshera, KP,
Pakistan

Correspondence Author: [email protected]

Received: Aug 03, 2024; Accepted: Aug 19, 2024; Published: Sep 12, 2024

ABSTRACT
Standard identification methods are flattering and less effective as attacks from malware
get increasingly sophisticated. Considering current malware outbreaks employ tactics
such as polymorphism, obfuscation and encryption, to avert identification, growing
complicated approaches must be developed. This paper deals with a mixed model
utilizing Deep Belief Neural Network (DBNN) for classifying and Grey Wolf
Optimization (GWO) for choosing features. Whereas DBNN encodes complicated
patterns by hierarchical learning, GWO optimizes the choosing of the more essential
features, lowering the cost of computing and dataset complexity. Investigations reveal
that the suggested GWO-DBNN model beats existing machine learning procedures in

Int. J. Elect. Crime Investigation 8(3): IJECI MS.ID- 05 (2024) 67

 Enhanced Malware Detection Using Grey Wolf Optimization and Deep Belief Neural Networks

terms of detection accuracy, recall, precision, and false positive rate (FPR). These mixed
tactics offer dependable and scalable solutions to the challenges faced by modern
malware threats.

Keywords: Deep neural networks, DNNs, Malware analysis, Feature Engineering,

Metaheuristic algorithms

behavior by hiding the real code from

monitoring systems [5]. According to
1. INTRODUCTION
authors [6], these approaches greatly
Malware, shorthand for "harmful reduce the efficacy of static signature-
software," is one of the largest and most based identification, forcing the use of
major risks to broad cybersecurity more dynamic strategies that might
nowadays. This word covers a wide evolve with these dynamic challenges.
range of hazardous software forms, According to the authors [7] with the
spanning viruses, worms, ransomware, quick augmentation in the variation of
spyware, and others. Malware attacks malware methods, ML and DL have
have risen dramatically in the past few developed into acute tools in advocate
years, owing to the expansion of the identification of malware. These
correlated networks, the rise of cloud approaches can cultivate behaviors and
computing, and the rapidly evolving patterns from historical data, clearing
digital world [1]. Typically, the them to recognize known and evolving
identification of malware relies on malware whereas depending on
signature-based platforms which match prearranged signature. According to the
established signatures for recognizing authors, ML methods [8] containing
potential dangers [2]. While such Naïve Bayes, Support Vector Machines
devices have been useful in the past, (SVM), and Random Forests may
they endure considerable constraints rationalize classifying via examination
especially whenever it comes to of dynamic and static features.
identifying zero-day attacks [3]. The authors [1] describe the typical
According to authors [4], innovative machine learning approaches could
methods of evasion involving have trouble with highly dimensional
polymorphism are employed by raw data, which might contain
contemporary malware creators for unimportant or replicate features.
allowing their harmful software to alter According to [6][17], over fitting is
its code architecture without losing its possible if models operate effectively
ability to trigger harm. Also, methods with data used for training but harshly
of obfuscation make it more on data that is not known. Besides,
challenging for ordinary antivirus dataset with high dimensions augments
programs to identify hazardous the computing cost, execution it

Int. J. Elect. Crime Investigation 8(3): IJECI MS.ID- 05 (2024) 68

 Enhanced Malware Detection Using Grey Wolf Optimization and Deep Belief Neural Networks

unfitting for real-time revealing of sinking computational burden.

viruses. The authors [2] described 2. By engaging GWO, the suggested
competent selection of features is methodology effectually addresses
vivacious to lowering redundancy and the tasks impersonated by high-
keeping valued properties for dimensional data samples, which
categorization frequently cover irrelevant or
This research presents an optimized redundant features. This effects in
architecture incorporating GWO for a reduction of overfitting and
picking features with DBNN for advances the generality of the
classifying. [6] Devised GWO, a model, constructing it more
metaheuristic algorithm inspired by appropriate for actual malware
grey wolf social structures and hunt revealing.
tactics that can quickly traverse huge 3. By utilizing DBNN, the framework
searching areas and select finest subset may automatically recognise
of attributes. The authors [5] discovered hierarchy relationships in malware
that GWO successfully decreases the knowledge, boosting its ability to
complexity of challenging malware recognize malware variations that
samples. DBNN are an unsupervised have been identified and those
neural network architecture made which are unknown. When
consisting of layers of Restricted contrasted with typical machine
Boltzmann Machine. DBNNs can learning methods, the architecture
acquire hierarchical structures from of deep learning delivers superior
vast data sets while enhancing the accuracy in classification since it
accuracy of classification by can deal with complicated feature
automatically recognizing complex interactions more effectively.
connections among characteristics [8] 4. The hybrid GWO-DBNN structure
[9]. delivers an accessible result for
Main Contributions dynamic and real-time malware
1. This paper leads an optimized revealing, capable of adjusting to
structure that incorporates GWO embryonic malware dangers such
for the selection of the features as obfuscated and polymorphic
with DBNN for malware malware. This creates the model
classifying tasks. The utilization of appropriate for disposition in
GWO advances feature collection modern cybersecurity situations
by competently decreasing the size where fast and adaptive detection
of the data samples, guaranteeing is critical.
that only the best appropriate The remainder of the paper is organized
features are employed, as: Section 2 deliberates related work,
subsequently augmenting Section 3 introduces our metaheuristic
classification enactment and algorithm and deep-learning technique

Int. J. Elect. Crime Investigation 8(3): IJECI MS.ID- 05 (2024) 69

 Enhanced Malware Detection Using Grey Wolf Optimization and Deep Belief Neural Networks

to malware detection classification, and are used in dynamic study to classify

Section 4 evaluates its performance in malware based on behavioral
comparison to existing malware characteristics. SVM has had some
success in dynamic analysis, but it
detection. Section 5 takes the paper to
struggles when dealing with huge
its conclusion. amounts of data samples.
Despite these advances, traditional
2. LITERATURE REVIEW machine learning models still struggle
with high-dimensional data—datasets
that include numerous irrelevant or
2.1. Machine Learning and Malware redundant features. Such data can lead
Detection to overfitting, where the model
performs well on training data but
In the domain of malware detection,
poorly on unseen data [7][10]. Besides,
there are primarily two types of
analysis: static analysis and dynamic high-dimensional data samples
analysis. Static analysis involves upsurges the computational difficulty
extracting features from the malware of the models, restraining their
code without executing it. Commonly applicability in real-time malware
extracted features include opcode revealing scenarios. Consequently, real
sequences, bytecode frequencies, and feature variety is crucial in augmenting
control flow graphs[1]. Naïve Bayes the enactment of ML models for
and Decision Trees were among the malware revealing by decreasing
irrelevant data while stabilizing the
earliest machine learning (ML) models
most informative features.
used in static analysis. For example, the
authors pioneered the use of Naïve
Bayes to classify malware based on
binary byte sequences, which
represented a breakthrough in
automated malware detection. While 2.2. Feature Selection Technique
static examination has been highly Feature selection plays a critical role in
successful, current malware frequently improving the performance of machine
uses code obfuscation and learning models, particularly when
polymorphism methodologies, causing dealing with large, high-dimensional
static approaches fewer effective since datasets such as those used in malware
malware could alter its appearance detection. Feature selection helps
while still expressing hazardous reduce the dataset size, making the
behaviors. model more efficient by eliminating
Dynamic analysis, on the other hand, irrelevant and redundant features.
implements malware in a controlled Traditional filter-based methods such
environment (for example a sandbox), as Chi-square and Information Gain
consenting its behavior to be monitored evaluate the significance of each feature
in the real time. This tactic records independently of the classification
runtime behavior, containing network algorithm. While these methods are
activity and system calls and, making it computationally efficient, they often
difficult for malware to evade fail to capture complex interactions
detection. ML processes such as SVM between features, which is essential in

Int. J. Elect. Crime Investigation 8(3): IJECI MS.ID- 05 (2024) 70

 Enhanced Malware Detection Using Grey Wolf Optimization and Deep Belief Neural Networks

malware datasets. Neural Networks (DNNs) have been

To address these limitations, employed to automatically extract and
researchers easily adopted learn patterns from large malware
metaheuristic algorithms such as datasets. DL models offer the
Genetic Algorithms (GA), Particle advantage of learning hierarchical
Swarm Optimization (PSO), and Ant features, which allows them to
Colony Optimization (ACO) for feature generalize better than traditional
selection [7]. These algorithms are for machine-learning methods that rely on
searching high-dimensional feature manual feature extraction.
spaces, as they balance exploration DBNNs are distinguished from other
(searching through the solution space) deep learning models by their capacity
and exploitation (refining the best to grip complicated data samples like
solutions found) during the feature those used in malware classification.
selection process. However, each DBNNs are constructed up of many
method has its drawbacks. For example, layers of Restricted Boltzmann
PSO is prone to slow convergence, Machines (RBMs), which are
while ACO can have high unsupervised learning processes.
computational overhead. RBMs aim to acquire a probabilistic
In [6] the authors stated the GWO representation of the input data by
procedure that was recognized as an minimizing the variations between the
effective choice for highly dimensional real input and the rebuilt output. After
feature selection challenges. Motivated initial training on RBMs, refine the
by the hunting behavior and social DBNN with backpropagation to
structure of grey wolves in the natural optimize the system for classifications.
world, GWO classifies them as alpha, The structural design of DBNNs marks
beta, and delta wolves, with alpha them as compatible with discovering
wolves being the most beneficial sophisticated malware, for example,
solution. The technique optimizes they are accomplished by learning
exploitation and exploration by altering multiple stages of abstraction from raw
the wolf's location concerning the most input features. This facility to model
suitable feature set, allowing for rapid deep non-linear relations between
and effective convergence. It makes features tolerates DBNNs to classify
GWO exceptionally excellent for complex malware designs that may be
processing huge, complicated data sets, neglected by typical ML models. In this
such as those encountered in detecting examination, the combination of GWO
malware. for feature assortment and DBNNs for
classification is offered to optimize the
accuracy of the feature selection and
2.3. Deep Learning in Malware classification in malware revealing.
Classification
Deep Learning (DL) models have been
3. METHODOLOGY
transformative in the field of malware
detection, particularly in handling high-
dimensional data. Convolutional 3.1. Data Preprocessing
Neural Networks (CNNs), Recurrent
Neural Networks (RNNs), and Deep The processing of data is an essential
phase in prepping the dataset for use in

Int. J. Elect. Crime Investigation 8(3): IJECI MS.ID- 05 (2024) 71

 Enhanced Malware Detection Using Grey Wolf Optimization and Deep Belief Neural Networks

training and classifications. The actual model that was suggested. Five-
malware datasets utilized in the present fold cross-validation is
research were derived from the implemented to verify stability
Microsoft Malware Classification
while avoiding overfitting.
Challenge [9] on Kaggle. This
collection includes more than 10,000
3.2. Feature Selection using Grey
samples from numerous malware
Wolf Optimization (GWO)
families, among them Ramnit, Simda,
Kelihos, and Vundo. The dataset covers The procedure called GWO [11] [12] is
the static and dynamic information, a metaheuristic approach influenced by
such as system call traces and opcode grey wolves' natural hunting techniques
frequency, making it suitable for both and leadership framework. GWO
static and dynamic training. organizes wolves into four categories:
Preprocessing encompasses numerous alpha, beta, delta, and omega. The alpha
stages: wolf reveals the optimum respond
 Missing values can have a serious (optimal feature subset), whilst the beta
influence on the model's and delta wolves direct the search
efficiency. In this research, the process.
The GWO method estimates the
missing data has been solved via
distance that exists among the wolves
mean imputation for numerical and their prey and repeatedly updates
parameters and median imputation their locations to arrive at the optimal
for categorical characteristics. response. The location of updates are
 Normalization applies Min-Max determined using the following formula
scaling to align every value of the as:
𝐷∝ = |𝐶1 . 𝑋∝ (𝑡) = 𝑋(𝑡)| (1)
feature across 0 and 1. This
Xα provides the alpha wolf's position,
guarantees that characteristics with while Dα provides the distance from the
wide ranges do not have an optimal feature subset. The technique
excessive effect on the learning repeatedly alters the wolves'
process. placements to reduce the space of
 For categorical features, such as features and pick the most appropriate
subset for categorization.
malware families, one-hot
encoding is used to convert 3.3. Classification Using Deep Belief
categorical values into binary Neural Networks (DBNN)
vectors. This avoids any ordinal The architecture of DBNN is shown in
interpretation of categorical figure 1. After identifying the
variables, ensuring that the model appropriate feature subset with GWO,
does not infer unnecessary DBNN employs it for identifying
relationships between malware malware. DBNNs are made up of
numerous layers of Restricted
families. Boltzmann Machines (RBMs) that are
 The dataset is divided into train unsupervised learning models [13][14].
(80%) and test (20%) batches for RBM learns to rebuild input by
evaluating the efficacy of the retaining the statistical connections

Int. J. Elect. Crime Investigation 8(3): IJECI MS.ID- 05 (2024) 72

 Enhanced Malware Detection Using Grey Wolf Optimization and Deep Belief Neural Networks

among hidden and visible units [15]. represents the learning rate. After
The weight adjustment for every RBM pretraining with RBMs, the DBNN is
follows a certain rule is fine-tuned using backpropagation
∆𝑊𝑖𝑗 = 𝜂(≺ 𝑉𝑖 ℎ𝑗 ≻𝑑𝑎𝑡𝑎 − (≺ method to classify malware as either
𝑉𝑖 ℎ𝑗 ≻𝑟𝑒𝑐𝑜𝑛 ) (2) malicious or benign based on the
Where ℎ𝑗 is the hidden unit, 𝑉𝑖 optimized feature subset. The flow
designates the visible unit, and η diagram of the whole methodology has
been shown in figure 2
.

Figure 1: Architecture of DBNN

Int. J. Elect. Crime Investigation 8(3): IJECI MS.ID- 05 (2024) 73

 Enhanced Malware Detection Using Grey Wolf Optimization and Deep Belief Neural Networks

Figure 2: Flow Diagram of the proposed GWO-DBNN Malware Detection

 Accuracy: Evaluate the proportion

4. RESULTS of correctly classified instances
amid the total instances.
The proposed GWO-DBNN model was
evaluated using key performance  Recall: Replicates the proportion
metrics such as accuracy, precision, of true positive detections mid all
recall, F1-score, and false positive rate actual positive instances.
(FPR). The results were compared  Precision: Designates the
against traditional machine learning proportion of true positive
models like SVM, Naïve Bayes, and detections between all positive
Decision Trees.
predictions.
4.1. Performance Metrics  F1-Score: The harmonic means of
To assess the efficacy of the GWO- recall and precision, providing a
DBNN model, the following balance between the two.
performance metrics have been  FPR: The rate at which benign
employed: samples are incorrectly categorized
as malicious.

Int. J. Elect. Crime Investigation 8(3): IJECI MS.ID- 05 (2024) 74

 Enhanced Malware Detection Using Grey Wolf Optimization and Deep Belief Neural Networks

4.2. Quantitative Results proposed GWO-DBNN model

consistently outperformed traditional
The table below summarizes the
ML models across all metrics,
performance of the GWO-DBNN
particularly in terms of reducing false
model compared to traditional ML
positives and improving overall
models on the malware detection task:
accuracy.
From the Figure 3, it is cleared that

Table 1: Performance Comparison

Model Accuracy Recall Precision F1-score FPR

SVM 91.50% 90.8% 90.0% 89.40% 3.0%
Decision Tree 89.70% 87.40% 88.90% 87.80% 3.4%
Nave Bayes 88.20% 86.50% 86.40% 85.70% 4.0%
GWO-DBNN 95.80% 93.8% 93.70% 94.10% 1.7%

Figure 3: Comparative analysis of Malware Detection Model

approaches [15]. By using GWO for

feature selection, the model decreases
5. DISCUSSION the dataset's dimensionality, increasing
computing efficiency and classification
The experimental findings show that accuracy.
the GWO-DBNN model improves The inclusion of DBNN enhances the
malware identification and model's performance by enabling
classification over standard ML hierarchical feature learning, which

Int. J. Elect. Crime Investigation 8(3): IJECI MS.ID- 05 (2024) 75

 Enhanced Malware Detection Using Grey Wolf Optimization and Deep Belief Neural Networks

allows the network to automatically arXiv:1804.04637, pp. 1-12, 2018.

recognize complicated patterns in [4] G. Suarez-Tangil, J. E. Tapiador, P.
malware behavior. The combined use Peris-Lopez, and J. Blasco, “Dendroid:
A text mining approach to analyzing
of GWO and DBNN has shown to be a
and classifying code structures in
viable technique for dealing with Android malware families,” Expert
current malware issues such as Systems with Applications, vol. 41, pp.
obfuscation or zero-day attacks. 1104-1117, 2014.
[5] X. Xu, H. Shen, and H. Chen,
“Trafficav: An effective and
6. CONCLUSION explainable detection of mobile
This article describes a unique hybrid malware behavior using network
system for identifying malware traffic,” Proceedings of the 2016
IEEE/ACM International Symposium
utilizing GWO for choosing features
on Quality of Service, pp. 1-10, 2016.
and DBNN for classifications. The [6] S. Mirjalili, S. M. Mirjalili, and A.
suggested approach outperforms Lewis, “Grey wolf optimizer,”
standard machine learning methods in Advances in Engineering Software, vol.
terms of malware detection, precision, 69, pp. 46-61, 2014.
accuracy, and computing the economy [7] Y. Ye, D. Wang, T. Li, and D. Ye,
at large. “An intelligent PE-malware detection
system based on association mining,”
Future work will focus on further
Journal of Computer Virology, vol. 4,
optimizing the model, investigating pp. 323-334, 2008.
other deep learning architectures, and [8] Y. Bengio, “Learning deep
increasing its application to other architectures for AI,” Foundations and
cybersecurity concerns such as Trends in Machine Learning, vol. 2, pp.
ransomware and intrusion detection. 1-127, 2009.
[9] Z. Ahmad, M. S. Pathan, and A.
Wajahat, “A comparative analysis of
REFERENCES malware detection methods:
Traditional vs. machine learning,”
[1] M. G. Schultz, E. Eskin, F. Zadok,
International Journal for Electronic
and S. J. Stolfo, “Data mining methods
Crime Investigation, vol. 7, pp. 3-18,
for detection of new malicious
2023.
executables,” Proceedings of the IEEE
[10] R. Ahmad, H. Salahuddin, A. U.
Symposium on Security and Privacy, Rehman, A. Rehman, M. U. Shafiq, M.
vol. 2001, pp. 1-11, 2001. A. Tahir, and M. S. Afzal, “Enhancing
[2] K. Rieck, P. Trinius, C. Willems, database security through AI-based
and T. Holz, “Automatic analysis of
intrusion detection system,” Journal of
malware behavior using machine Computing & Biomedical Informatics,
learning,” Journal of Computer vol. 7, pp. 1-12, 2024.
Security, vol. 19, pp. 639-668, 2011. [11] H. Rezaei, O. Bozorg-Haddad, and
[3] H. S. Anderson and P. Roth, X. Chu, “Grey wolf optimization
“Ember: An open dataset for training (GWO) algorithm,” in Advanced
static PE malware machine learning
Optimization by Nature-Inspired
models,” arXiv Preprint,

Int. J. Elect. Crime Investigation 8(3): IJECI MS.ID- 05 (2024) 76

 Enhanced Malware Detection Using Grey Wolf Optimization and Deep Belief Neural Networks

Algorithms, pp. 81-91, 2018.

[12] A. Bilal, A. Alzahrani, A.
Almuhaimeed, A. H. Khan, Z. Ahmad,
and H. Long, “Advanced CKD
detection through optimized
metaheuristic modeling in healthcare
informatics,” Scientific Reports, vol.
14, pp. 12601, 2024.
[13] R. Khan, N. Iltaf, M. U. Shafiq,
and F. U. Rehman, “Metadata-based
cross-domain recommender framework
using neighborhood mapping,” 2023
International Conference on
Sustainable Technology and
Engineering (i-COSTE), pp. 1-8, 2023.
[14] M. F. Chishti, M. Rao, M. W.
Raffat, and S. Rafi, “Estimating
corporate risk and corporate value: An
application of Altman’s Z-score on the
KSE-30 index,” International Journal of
Contemporary Issues in Social
Sciences, vol. 3, pp. 2833-2841, 2024.
[15] M. U. Shafiq and A. I. Butt,
“Segmentation of brain MRI using U-
Net: Innovations in medical image
processing,” Journal of Computational
Informatics & Business, vol. 1, pp. 1-
15, 2024.
[16] A. Ullah, M. Waqar, S. S. Nazir, A.
Adnan, M. A. Khan, M. W. Raffat, and
S. Rafi, “The impact of information
communication technology and
financial innovation on the financial
performance of Chinese commercial
banks,” Remittances Review, vol. 9, pp.
364-383, 2024
[17] M. Hamza, “Optimizing early
detection of diabetes through retinal
imaging: A comparative analysis of
deep learning and machine learning
algorithms,” Journal of Computational
Informatics & Business, vol. 1, no. 1,
pp. 1-12, 2024

Int. J. Elect. Crime Investigation 8(3): IJECI MS.ID- 05 (2024) 77