.png){kind=icon}
返回
Windows malware detection based on static analysis with multiple features
.png){kind=icon}
OA
AI
DOI：10.7717/peerj-cs.1319.png)
.png){kind=icon}
.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Malware or malicious software is an intrusive software that infects or performs harmful activities on a computer under attack. Malware has been a threat to individuals and organizations since the dawn of computers and the research community has been struggling to develop efficient methods to detect malware. In this work, we present a static malware detection system to detect Portable Executable (PE) malware in Windows environment and classify them as benign or malware with high accuracy. First, we collect a total of 27,920 Windows PE malware samples divided into six categories and create a new dataset by extracting four types of information including the list of imported DLLs and API functions called by these samples, values of 52 attributes from PE Header and 100 attributes of PE Section. We also amalgamate this information to create two integrated feature sets. Second, we apply seven machine learning models; gradient boosting, decision tree, random forest, support vector machine, K-nearest neighbor, naive Bayes, and nearest centroid, and three ensemble learning techniques including Majority Voting, Stack Generalization, and AdaBoost to classify the malware. Third, to further improve the performance of our malware detection system, we also deploy two dimensionality reduction techniques: Information Gain and Principal Component Analysis. We perform a number of experiments to test the performance and robustness of our system on both raw and selected features and show its supremacy over previous studies. By combining machine learning, ensemble learning and dimensionality reduction techniques, we construct a static malware detection system which achieves a detection rate of 99.5% and error rate of only 0.47%.
Keyword:
Static malware analysis
Windows PE
Machine learning
Multiple features
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
2.5
论文数:
3.4K
被引数:
6.9K
机构
引用论文
分享收藏Expression of IDO1 and PD-L2 in Patients with Benign Lymphadenopathies and Association with Autoimmune Diseases.png)
Biomolecules
OAAI
BiomoleculesIF0
OAAI分享收藏Comparative Analysis of Low-Dimensional Features and Tree-Based Ensembles for Malware Detection SystemsIEEE ACCESSOAAI
IEEE ACCESSIF3.6
OAAI分享收藏
查看更多内容