Efficient algorithm for malware classification: n-gram MCSC

Abstract

In this paper, we proposed n-gram MCSC. This method extracts n-gram opcode from execution file and use Simhash to make image of them. We measured and compared the performance metrics of n-gram MCSC and existing MCSC such as accuracy, loss, precision and AUC value of PR curve and ROC curve. To verify whether the difference of accuracy is significant statistically or not, we made experiments of it thirty times and did the ANOVA analysis. We found it was significant. As the result of post-hoc analysis, n-gram MCSC showed better result than existing MCSC in accuracy. The 2-gram MCSC showed the better result than 3gram MCSC in terms of accuracy, precision, AUC value of PR curve and ROC curve.

Detecting Malware Activities With MalpMiner: A Dynamic Analysis Approach

“…Authors in [40] suggested an n-gram approach for detecting malware samples; even though such an approach is intuitive, yet it computational costs are unbearable. Thus, most researchers utilize machine learning classifiers to detect malicious software by encoding the given sample into a feature vector and passing it to a trained model.…”