In the past few years, malware has become one of the most significant threats to computer security. Malware or malicious is software that attackers use or program to interrupt the operations of a computer, to collect secret or private information, or to access computer systems without being authorized to do. In this paper, we presented a machine learning based approach to classifying a portable executable (PE) file as benign or malware with high accuracy. The proposed approach used the static analysis technique to extract the integrated feature set, which was created by combining a few raw features selected from the three main headers of PE files and a set of derived features. Seven supervised learning algorithms are used in the classification of malware. We compared the performance of each classifier in terms of accuracy, precision, and F -measure. The experimental results indicate that the integrated feature set performs better than the raw feature set on all metrics. Integrated dataset accuracy values are between 91% and 99%, against the raw dataset values which are between 71% and 97% using (70/30) split method. Random Forest has outperformed all classifiers on both datasets (with accuracy of 99.23%).
Paper
Full text
Machine Learning Techniques to Detect Maliciousness of Portable Executable Files
Semantic Scholar · Computer Science · 2019
Abstract
In the past few years, malware has become one of the most significant threats to computer security. Malware or malicious is software that attackers use or program to interrupt the operations of a computer, to collect secret or private information, or to access computer systems without being authorized to do. In this paper, we presented a machine learning based approach to classifying a portable executable (PE) file as benign or malware with high accuracy. The proposed approach used the static analysis technique to extract the integrated feature set, which was created by combining a few raw features selected from the three main headers of PE files and a set of derived features. Seven supervised learning algorithms are used in the classification of malware. We compared the performance of each classifier in terms of accuracy, precision, and F -measure. The experimental results indicate that the integrated feature set performs better than the raw feature set on all metrics. Integrated dataset accuracy values are between 91% and 99%, against the raw dataset values which are between 71% and 97% using (70/30) split method. Random Forest has outperformed all classifiers on both datasets (with accuracy of 99.23%).