Improvement of Malware Classification Using Hybrid Feature Engineering

Abstract

Polymorphic malware has evolved as a major threat in Computer Systems. Their creation technology is constantly evolving using sophisticated tactics to create multiple instances of the existing ones. Current solutions are not yet able to sufficiently address this problem. They are mostly signature based; however, a changing malware means a changing signature. They, therefore, easily evade detection. Classifying them into their respective families is also hard, thus making elimination harder. In this paper, we propose a new feature engineering (NFE) approach for a better classification of polymorphic malware based on a hybrid of structural and behavioural features. We use accuracy, recall, precision, and F score to evaluate our approach. We achieve an improvement of 12% on accuracy between raw features and NFE features. We also demonstrated the robustness of NFE on feature selection as compared to other feature selection techniques.

Feature Subset Selection for Malware Detection in Smart IoT Platforms

“…The problem has continued to draw an increasing attention from researchers and practitioners alike [7,8,10,18,[21][22][23][24][25][26][27][28]. Although choosing a subset of features from the original features is a combinatorial problem, many suboptimal heuristics have been put forward and used in various domains, which include the chi-squared based feature subset selection [7,8,10], the analysis of variance (ANOVA) [7,8,10], mutual information [7,23,29] and information gain [18,[25][26][27]. Many studies have shown that feature selection approaches that select good feature subset will have significant impact on reducing the complexity in processing by eliminating unimportant features and enhance the performance of the learning models [24,30].…”

“…Generally, static and dynamic analysis methods are utilized to extract typical malware descriptive behaviour (i.e., features) from the raw data. These feature extraction methods normally generate very large high-dimensional, redundant and noisy features [ 10 , 11 ]. Some of the raw features offer little or no information that is useful to distinguish malware apps from benign apps and may even impact the performance of the malware detection methods [ 10 , 12 , 13 , 14 ].…”

“…Feature selection algorithms select a subset of features from the original feature set, which are considered useful for training the learning models to obtain good results [ 2 , 10 ]. A growing number of Android malware detection models have applied different feature subset selection algorithms and have achieved good detection rates [ 8 , 16 ].…”

“…A growing number of Android malware detection models have applied different feature subset selection algorithms and have achieved good detection rates [ 8 , 16 ]. However, research on the usefulness of the state-of-the-art feature subset selection methods in the context of Android malware detection models have not received the attention it deserves [ 10 ]. To this end, we investigate the utility of the commonly used feature subset selection approaches for malware detection in Android platforms.…”

Automated Malware Detection in Mobile App Stores Based on Robust Feature Generation

“…Initial research studies focused on permission-based detection, signature-based detection, system call-based detection, and sensitive API-based detection. Feature-selection algorithms such as information gain (IG), principal component analysis (PCA), Chi-Square (χ 2 ), and analysis of variance (ANOVA) were suggested to improve the detection performance [23]. Machine-learning techniques have also been applied to automate malware detection strategies [24].…”