Zero day malware detection in the windows ecosystem : a hybrid contrastive and behavioral learning approach

Abstract

The fast development of digitalization of the basic activities of the every-day life in this century has conditioned more dependence on the technological devices which made the observable enhancement of interdependence between the ecosystems, especially in Windows . With key areas of services, including banking, medical, and e-commerce services shifting to be online, the insecurities in these systems mean that more cyber jeopardy are faced by users, especially the zero-day malware attacks. Such attacks are also a huge challenge to cybersecurity on desktop and mobile platforms since they take advantage of vulnerabilities that cannot be easily identified and prevented. This thesis proposes a new hybrid method of detecting zero-day malware where ideas of contrastive and behavioral learning frameworks are combined. Through combination of these techniques, the proposed design will enhance the process of detecting and preventing unknown malware in windows platform. The hybrid detection system is able to sample the behavior of applications and compare against unique attributes, and provide a more flexible and effective barrier to defense. This method aims at giving input to the creation of scalable, real-time and Windowscentric platform security-solutions to address the shifting security requirements of the digital ecosystems.This paper proposes a staged framework for malware detection that increases its level of analysis gradually, from static filtering to behavioral modeling, self-supervised byte-level anomaly detection and network-wide monitoring, all within a single pipeline focusing on the Windows platform. Unlike other methods that rely on labeled malware datasets or a one-stage approach, this one focuses on a self-supervised approach and gradual risk assessment to effectively detect previously unseen malware, also known as zero-day malware which is the key novelty of this work.