# Detecting Malware C&C Communication Traffic Using Artificial Intelligence Techniques
## 2 Related Studies
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset and Algorithm** & \begin{tabular}{c} **Benign** \\ **TPR** \\ \end{tabular} & \begin{tabular}{c} **Benign** \\ **FPR** \\ \end{tabular} & \
\begin{tabular}{c} **Malware** \\ **TPR** \\ \end{tabular} &
\begin{tabular}{c} **Malware** \\ **FPR** \\ \end{tabular} \\ \hline Zeus–1—C4.5 & 86 & 17 & 83 & 14 \\ \hline Zeus–2—C4.5 & 96 & 1 & 99 & 4 \\ \hline Zeus (NETRESC)—C4.5 & 97 & 3 & 97 & 3 \\ \hline Zeus (Snort)—C4.5 & 98 & 12 & 88 & 2 \\ \hline Zeus–1—SBB & 80 & 27 & 73 & 20 \\ \hline Zeus–2—SBB & 96 & 1 & 99 & 4 \\ \hline Zeus (NETRESC)—SBB & 93 & 13 & 87 & 7 \\ \hline Zeus (Snort)—SBB & 98 & 2 & 98 & 2 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Classification results when used with Softflowd set.1 and 2. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset and Algorithm** & \begin{tabular}{c} **Benign** \\ **TPR** \\ \end{tabular} & \begin{tabular}{c} **Benign** \\ **FPR** \\ \end{tabular} & \
\begin{tabular}{c} **Malware** \\ **TPR** \\ \end{tabular} &
\begin{tabular}{c} **Malware** \\ **FPR** \\ \end{tabular} \\ \hline Zeus–1—C4.5 & 90 & 16 & 84 & 10 \\ \hline Zeus–2—C4.5 & 97 & 3 & 97 & 3 \\ \hline Zeus (NETRESC)—C4.5 & 97 & 6 & 94 & 3 \\ \hline Zeus (Snort)—C4.5 & 97 & 1 & 99 & 3 \\ \hline Zeus–1—SBB & 73 & 18 & 82 & 27 \\ \hline Zeus–2—SBB & 94 & 0 & 100 & 6 \\ \hline Zeus (NETRESC)—SBB & 87 & 7 & 93 & 13 \\ \hline Zeus (Snort)—SBB & 100 & 0 & 100 & 0 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Classification results when used with Softflowd set.2. The authors in [48] used a Convolutional Neural Network (CNN) to classify malware samples which included the banking malware variant Ramnit. The authors transformed the malware binary files into grayscale images, which then enabled the CNN to detect patterns that could be used to classify the malware. Ref. [48] built a CNN network which consisted of a convolutional layer, pooling layer, and fully connected layer. Features were generated by analyzing the executable files, and although many techniques exist to perform this, ref. [48] used the following methodology. First, 1600 unique opcodes were created, which then allowed [48] to use the opcode frequency as the discriminatory feature for the experimental work. To select the optimal number of features for the experimental work, ref. [48] used different dimensionality reduction techniques, which included the variance threshold approach, a single layer auto-encoder, and a three-layer stacked auto encoder. The authors in [49] used both machine learning and deep learning algorithms to build several models to train, test, and classify malware. The machine learning algorithm used was the random forest algorithm, and three deep learning models were used. The three deep learning models were architected using two hidden layers (DNN-2L), four hidden layers (DNN-4L), and seven hidden layers (DNN-7L). Ref. [48] used several criteria to measure the performance of the algorithms and models used, and these included accuracy, recall (true positive rate (TPR)), true negative rate (TNR), and precision (positive predictive value (PPV)). The experimental analysis produced good results. The lowest score was a precision score of 87.97%, achieved by the DNN-7L model, and the highest score was achieved by the RF model, with a PPV/precision score of 100. Fingerprinting Windows API system function calls is an approach developed by [49], in which the frequency of Windows API system function calls are captured and analyzed to identify malicious patterns. This approach also allows for various malware variants to be categorized based on their relationships. The relationship is determined by understanding and grouping common behaviors and patterns that are identified during the analysis stage. Around 65,000 malware samples were analyzed, and this was conducted using the Cuckoo Malware Sandbox, which allowed [49] to identify the name of the API calls being called and the number of times each API call was made. Ref.