Fine-Tuning Cyber Security Defenses: Evaluating Supervised Machine Learning Classifiers for Windows Malware Detection
Source abstract
Abstract
Malware attacks on Windows machines pose significant cybersecurity threats, necessitating effective detection and prevention mechanisms. Supervised machine learning classifiers have emerged as promising tools for malware detection. However, there remains a need for comprehensive studies that compare the performance of different classifiers specifically for Windows malware detection. Addressing this gap can provide valuable insights for enhancing cybersecurity strategies. While numerous studies have explored malware detection using machine learning techniques, there is a lack of systematic comparison of supervised classifiers for Windows malware detection. Understanding the relative effectiveness of these classifiers can inform the selection of optimal detection methods and improve overall security measures. This study aims to bridge the research gap by conducting a comparative analysis of supervised machine learning classifiers for detecting malware on Windows systems. The objectives include Investigating the performance of various classifiers, such as Gaussian Naïve Bayes, K Nearest Neighbors (KNN), Stochastic Gradient Descent Classifier (SGDC), and Decision Tree, in detecting Windows malware. Evaluating the accuracy, efficiency, and suitability of each classifier for real-world malware detection scenarios. Identifying the strengths and limitations of different classifiers to provide insights for cybersecurity practitioners and researchers. Offering recommendations for selecting the most effective classifier for Windows malware detection based on empirical evidence. The study employs a structured methodology consisting of several phases: exploratory data analysis, data preprocessing, model training, and evaluation. Exploratory data analysis involves understanding the dataset’s characteristics and identifying preprocessing requirements. Data preprocessing includes cleaning, feature encoding, dimensionality reduction, and optimization to prepare the data for training. Model training utilizes various supervised classifiers, and their performance is evaluated using metrics such as accuracy, precision, recall, and F1 score. The study’s outcomes comprise a comparative analysis of supervised machine learning classifiers for Windows malware detection. Results reveal the effectiveness and efficiency of each classifier in detecting different types of malware. Additionally, insights into their strengths and limitations provide practical guidance for enhancing cybersecurity defenses. Overall, this research contributes to advancing malware detection techniques and bolstering the security posture of Windows systems against evolving cyber threats.
Source: openalex_inverted_index · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Digital and Cyber Forensics
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
References (50)
Show source-provided references
1. Dynamic analysis of malicious code10.1007/s11416-006-0012-2 ↗
2. Deep neural network-based malware detection using two dimensional binary program features
3. Dynamic malware analysis in the modern era—A state of the art survey10.1145/3329786 ↗
4. A simple method for detection of metamorphic malware using dynamic analysis and text mining10.1016/j.procs.2015.06.031 ↗
5. Novel feature extraction selection and fusion for effective malware family classification
6. Data augmentation-based malware detection using convolutional neural networks10.7717/peerj-cs.346 ↗
7. MTHAEL: Cross-architecture IoT malware detection based on neural network advanced ensemble learning10.1109/TC.2020.3015584 ↗
8. Classification of malware programs using autoencoders based deep learning architecture and its application to the microsoft Malware classification challenge (BIG 2015) dataset
9. Toward automated dynamic malware analysis using CW sandbox10.1109/MSP.2007.45 ↗
10. A state-of-the-art survey of malware detection approaches using data mining techniques10.1186/s13673-018-0125-x ↗
11. Large-scale malware classification using random projections and neural networks
12. Malware analysis and classification: A survey
13. PE-Miner: Mining structural information to detect malicious executables in realtime
14. Malware classification method based on word vector of bytes and multilayer perception
15. Polymorphic malware detection using sequence classification methods and ensembles
16. Classification of malware using structured control flow
17. A survey of the recent architectures of deep convolutional neural networks10.1007/s10462-020-09825-6 ↗
18. Cross-method-based analysis and classification of malicious behavior by API calls extraction10.3390/app9020239 ↗
19. Zhang · Future Gener. Comput. Syst. · Jan. 2019 · 90 · 21110.1016/j.future.2018.07.052 ↗
20. Visualized malware multi-classification framework using fine-tuned CNN-based transfer learning models10.3390/app11146446 ↗
21. A survey of malware detection using deep learning
22. DL4MD: A deep learning framework for intelligent malware detection
23. Tools & techniques for malware analysis and classification
24. Malware detection based on deep learning algorithm10.1007/s00521-017-3077-6 ↗
25. Enhancing the security in cyber-world by detecting the botnets using ensemble classification-based machine learning10.1016/j.measen.2022.100624 ↗
26. A survey of the recent trends in deep learning based malware detection10.3390/jcp2040041 ↗
27. Malware detection on highly imbalanced data through sequence modeling
28. Malware classification using deep learning methods
29. Analyzing and classifying malware types on windows platform using an ensemble machine learning approach10.23940/ijpe.24.05.p6.312318 ↗
30. Intelligent dynamic malware detection using machine learning in IP reputation for forensics data analytics10.1016/j.future.2021.01.004 ↗
31. J. Zhang, “Machine learning with feature selection using principal component analysis for malware detection: A case study,” arXiv:1902.03639, 2019.
32. On the effectiveness of machine and deep learning for cyber security
33. MCFT-CNN: Malware classification with fine-tune convolution neural networks using traditional and transfer learning in Internet of Things10.1016/j.future.2021.06.029 ↗
34. Self-supervised vision transformers for malware detection10.1109/ACCESS.2022.3206445 ↗
35. Malware detection method based on the control-flow construct feature of software10.1049/iet-ifs.2012.0289 ↗
36. ASSCA: API sequence and statistics features combined architecture for malware detection
37. Enhancing IoT-based software defect prediction in analytical data management using war strategy optimization and Kernel ELM
38. Automated dynamic approach for detecting ransomware using finite-state machine10.1016/j.dss.2020.113400 ↗
39. Detection of malware by deep learning as CNN-LSTM machine learning techniques in real time10.3390/sym14112308 ↗
40. Cyber security threats detection in Internet of Things using deep learning approach10.1109/ACCESS.2019.2937347 ↗
41. Machine learning for Internet of Things data analysis: A survey10.1016/j.dcan.2017.10.002 ↗
42. Toward edge-based deep learning in industrial Internet of Things10.1109/JIOT.2019.2963635 ↗
43. A decomposition of the outlier detection problem into a set of supervised learning problems10.1007/s10994-015-5507-y ↗
44. Classification based on decision tree algorithm for machine learning10.38094/jastt20165 ↗
45. On the classification of microsoft-windows ransomware using hardware profile10.7717/peerj-cs.361 ↗
46. A survey on mobile malware detection techniques10.1587/transinf.2019INI0003 ↗
47. ERNN: Error-resilient RNN for encrypted traffic detection towards network-induced phenomena
48. Classification of software failure incidents using SVM
49. BugPre: An intelligent software version-to-version bug prediction system using graph convolutional neural networks10.1007/s40747-022-00848-w ↗
50. Botnet-based IoT network traffic analysis using deep learning10.1002/spy2.355 ↗