Windows malware detection based on static analysis with multiple features

Abstract

Malware or malicious software is an intrusive software that infects or performs harmful activities on a computer under attack. Malware has been a threat to individuals and organizations since the dawn of computers and the research community has been struggling to develop efficient methods to detect malware. In this work, we present a static malware detection system to detect Portable Executable (PE) malware in Windows environment and classify them as benign or malware with high accuracy. First, we collect a total of 27,920 Windows PE malware samples divided into six categories and create a new dataset by extracting four types of information including the list of imported DLLs and API functions called by these samples, values of 52 attributes from PE Header and 100 attributes of PE Section. We also amalgamate this information to create two integrated feature sets. Second, we apply seven machine learning models; gradient boosting, decision tree, random forest, support vector machine, K-nearest neighbor, naive Bayes, and nearest centroid, and three ensemble learning techniques including Majority Voting, Stack Generalization, and AdaBoost to classify the malware. Third, to further improve the performance of our malware detection system, we also deploy two dimensionality reduction techniques: Information Gain and Principal Component Analysis. We perform a number of experiments to test the performance and robustness of our system on both raw and selected features and show its supremacy over previous studies. By combining machine learning, ensemble learning and dimensionality reduction techniques, we construct a static malware detection system which achieves a detection rate of 99.5% and error rate of only 0.47%.

The current landscape of digital forensics employing machine learning approaches: A Review

“…The researchers used Python programming language under the Jupyter platform for implementing their model codes. In additional, in [58] employed seven machine learning classifiers (Naïve Bayes, SVM, Decision, Random Forest, KNN, Nearest Centroid and Gradient Boost) in classifying 29,797 samples of Portable Executable (PE) malware collected from various sources including files from Windows installation. The best obtained accuracy was with Random Forest with PCA as dimensionality reducer reached 99.41%.…”

“…Issues related to multicollinearity [57] 2022 Analysis and investigate Malware Forensic PCA, K-Means Detecting zero-day attacks using ML approaches and feature engineering. [58] 2023 Malware Forensic PCA Static malware detection framework by mining DLLs, and API calls from each DLL using ML approach and feature selecting.…”

“…[52] SVM Imbalanced Datasets SVM has difficulties dealing with the imbalanced data set that occasionally characterizes digital forensic data. [58] PCA Assumption of Linearity…”