Aprendizado de máquina e interpretabilidade com SHAP para detecção de spyware em dados de memória

Abstract

Information security faces increasing challenges with the advancement of sophisticated cyber threats, such as spyware. These malwares operate silently, making them difficult to detect using traditional signature-based solutions. This work proposes the development of a machine learning-based algorithm for spyware detection through volatile memory analysis, using the CIC-MalMem-2022 dataset. Preprocessing, feature selection, and cross-validation techniques were applied to train and evaluate four models: Decision Tree, Naive Bayes, Support Vector Machine (SVM), and Neural Network. The evaluation of the models considered metrics such as accuracy and inference time. The results demonstrated that it is possible to identify malicious behaviors related to spyware with high precision using datasets extracted from memory. This study contributes to the advancement of intelligent approaches in cybersecurity, exploring a type of threat that is little addressed in relation to other types of malware.