Modified K-Neighbor Outperforms Logistic Regression and Random Forest in Identifying Host Malware Across Limited Data Sets

Abstract

Using probabilistic risk assessment and decision-making methodology, this study analyzes and manages risks to Supervisory Control and Data Acquisition (SCADA) systems that are made on purpose. Seemingly, the attacker can launch attacks anywhere in the world from a single place. Viruses and other dangerous executables tend to stay in the system for a while and then spread their copy to other systems on the network. One of the greatest issues for security experts is detecting cyber-attacks and starting immediate recovery from them when they have spread across the entire system at a triggered time and are doing significant harm. Any SCADA system that has been compromised can have an effect on the functioning of functional blocks and measured parameters, changes in the operating circumstances of the installations, and abnormal beginnings, stops, and modifications to the installed units as instructed by the attackers. Samples are represented as a separate byte file in this study after the raw dataset has been preprocessed. The byte file is used for both testing and training prediction models using statistical processes, which can then be utilized to detect malware in critical infrastructure systems. Finding malicious executables based on both nature and signature is the focus of this study. Each model's conclusion is found on limited malware data samples; however, these samples produce convincing results for previously unidentified malware. The results of the experiments reveal that, when there are few training samples available for a given harmful file, modified K-neighbor outperforms Logistic Regression and Random Forest.