An Efficient Mining Based Approach Using PSO Selection Technique For Analysis and Detection of Obfuscated Malware

Abstract

Malware plays a threatening role to the security of the data and information systems, as they created in different forms targeting data and networks. Malware developers use obfuscation techniques to hide malwares structure from detection of Anti-Virus (AV) programs, which use signature based detection; it is almost hard to detect the zero day attack and ineffective to analyze the hidden structure of malware. Such malicious codes are categorized as Oligomorphic, polymorphic and metamorphic Malware. Malware writers use packing mechanism to keep the malicious code harder during the signature-based detection and bypass easily. Mining techniques are one of the promising methods to analyze and detect hidden malware based on clustering and classification. This research focuses on improving accuracy and reducing processing time in the classification phase. This research approach mainly focused on the optimal attribute selection for classification to get the desired output. The proposed model uses Particle Swarm Optimization (PSO) for best attribute selection from the features set extracted from the packed and non-packed Portable Executable (PE) file format of malware and benign dataset. Classification tests have been prepared on the optimal subset of PE features in which Random Forrest classification outperforms from the rest of the classification algorithm.

XGBoost Algoritması ile İkili Parçacık Sürü Optimizasyonu Öznitelik Seçme Tabanlı Jar Kötü Amaçlı Yazılımlarının Tespiti

“…SI algoritmaları arasında, parçacık sürü optimizasyonu (PSO), öznitelik seçimi için en yaygın olarak kullanılan algoritmadır. Kötü amaçlı yazılım sınıflandırma alanında dikkate değer bir başarıyla uygulanmıştır [18][19][20][21] .…”