Windows PE Malware Detection Using Ensemble Learning

Nureni Ayofe Azeez

doi:10.3390/informatics8010010

Return

Windows PE Malware Detection Using Ensemble Learning

2021-02-10

Nureni Ayofe Azeez

Oluwanifise Ebunoluwa Odufuwa

Sanjay Misra

Jonathan Oluranti

Robertas Damaševičius *

DOI：10.3390/informatics8010010

Original

Save

View PDF

Abstract

En 中文

In this Internet age, there are increasingly many threats to the security and safety of users daily. One of such threats is malicious software otherwise known as malware (ransomware, Trojans, viruses, etc.). The effect of this threat can lead to loss or malicious replacement of important information (such as bank account details, etc.). Malware creators have been able to bypass traditional methods of malware detection, which can be time-consuming and unreliable for unknown malware. This motivates the need for intelligent ways to detect malware, especially new malware which have not been evaluated or studied before. Machine learning provides an intelligent way to detect malware and comprises two stages: feature extraction and classification. This study suggests an ensemble learning-based method for malware detection. The base stage classification is done by a stacked ensemble of fully-connected and one-dimensional convolutional neural networks (CNNs), whereas the end-stage classification is done by a machine learning algorithm. For a meta-learner, we analyzed and compared 15 machine learning classifiers. For comparison, five machine learning algorithms were used: naive Bayes, decision tree, random forest, gradient boosting, and AdaBoosting. The results of experiments made on the Windows Portable Executable (PE) malware dataset are presented. The best results were obtained by an ensemble of seven neural networks and the ExtraTrees classifier as a final-stage classifier.

Keywords:

malware detection

deep learning

ensemble learning

stacking