# Assessing Cyclostationary Malware Detection via Feature Selection and Classification

arXiv: https://arxiv.org/abs/2308.15237 · HTML: https://mlsanity.com/paper/2308.15237/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 7 of its 29 references that are in the map.
- First posted on arXiv 29 Aug 2023.

## Builds on (most cited first, 7 of 7)

- [Zero-Day Threats Detection for Critical Infrastructures](https://mlsanity.com/paper/2306.06366/) (2023)
- [Detection of cybersecurity attacks through analysis of web browsing activities using principal component analysis](https://mlsanity.com/paper/2107.12592/) (2021)
- [Fuzzy Feature Selection with Key-based Cryptographic Transformations](https://mlsanity.com/paper/2306.09583/) (2023)
- [Data Protection for Data Privacy-A South African Problem?](https://mlsanity.com/paper/2306.09934/) (2023)
- [Fuzzification-based Feature Selection for Enhanced Website Content Encryption](https://mlsanity.com/paper/2306.13548/) (2023)
- [Navigating the complex nexus: cybersecurity in political landscapes](https://mlsanity.com/paper/2308.08005/) (2023)
- [Software-based signal compression algorithm for ROM-stored electrical cables](https://mlsanity.com/paper/2308.11620/) (2023)

## Abstract (arXiv)

Cyclostationarity involves periodic statistical variations in signals and processes, commonly used in signal analysis and network security. In the context of attacks, cyclostationarity helps detect malicious behaviors within network traffic, such as traffic patterns in Distributed Denial of Service (DDoS) attacks or hidden communication channels in malware. This approach enhances security by identifying abnormal patterns and informing Network Intrusion Detection Systems (NIDSs) to recognize potential attacks, enhancing protection against both known and novel threats. This research focuses on identifying cyclostationary malware behavior and its detection. The main goal is to pinpoint essential cyclostationary features used in NIDSs. These features are extracted using algorithms such as Boruta and Principal Component Analysis (PCA), and then categorized to find the most significant cyclostationary patterns. The aim of this article is to reveal periodically changing malware behaviors through cyclostationarity. The study highlights the importance of spotting cyclostationary malware in NIDSs by using established datasets like KDD99, NSL-KDD, and the UGRansome dataset. The UGRansome dataset is designed for anomaly detection research and includes both normal and abnormal network threat categories of zero-day attacks. A comparison is made using the Random Forest (RF) and Support Vector Machine (SVM) algorithms, while also evaluating the effectiveness of Boruta and PCA. The findings show that PCA is more promising than using Boruta alone for extracting cyclostationary network feature patterns. Additionally, the analysis identifies the internet protocol as the most noticeable cyclostationary feature pattern used by malware. Notably, the UGRansome dataset outperforms the KDD99 and NSL-KDD, achieving 99% accuracy in signature malware detection using the RF algorithm and 98% with the SVM.