Heuristic Malware Detection Mechanism Based on Executable Files Static Analysis

Abstract

To ensure the protection of information processed by computer systems is currently the most important task in the construction and operation of the automated systems. The paper presents the application justification of a new set of features distinguished at the stage of the static analysis of the executable files to address the problem of malicious code detection. In the course of study, following problems were solved: development of the executable files classifier in the absence of a priori data concerning their functionality; designing class models of uninfected files and malware during the learning process; development of malicious code detection procedure using the neural networks mathematical apparatus and decision tree composition relating to the set of features specified on the basis of the executable files static analysis. The paper also describes the functional model of malware detection system using the executable files static analysis. The conclusion contains the results of experimental evaluation of the developed detection mechanism efficiency on the basis of neural networks and decision tree composition. The obtained data confirmed the hypothesis about the possibility of constructing the heuristic malware analyzer on the basis of features distinguished during the static analysis of the executable files. However, the approach based on the decision tree composition enables to obtain a significantly lower false negative rate probability with the specified initial data and classifier parameter values relating to neural networks.

Tight Arms Race: Overview of Current Malware Threats and Trends in Their Detection

“…Since malware detection is typically a classification task, various classical ML-based classifiers have been employed, such as logistic regression [135], SVMs [136], [137], knearest neighbors (k-NNs) [138], [139], decision trees [140], RFs [141], Naïve Bayes classifiers [142]. They operate in various feature spaces, containing either static features, such as strings (e.g., filenames, code fragments), N-grams, API calls, entropy, malware representation as a gray scale image, function call graphs (FCGs), CFGs, or dynamic ones: values of the memory contents at runtime, dynamic instruction traces (sequences of processor instructions called during the execution of a program), OpCodes [143], network traffic parameters or API call traces [16].…”

MalCaps: A Capsule Network Based Model for the Malware Classification

“…Combining these static and dynamic features to detect malicious software can achieve higher performance [24]. Models used for training include logistic regression [25], SVM [26], k-nearest neighbor (k-NN) [27], decision tree [28], random forest [29], and so on. The newest research on the machine learning-based malware detection focus on innovative feature spaces.…”