MLMD—A Malware-Detecting Antivirus Tool Based on the XGBoost Machine Learning Algorithm
Source abstract
Abstract
This paper focuses on training machine learning models using the XGBoost and extremely randomized trees algorithms on two datasets obtained using static and dynamic analysis of real malicious and benign samples. We then compare their success rates—both mutually and with other algorithms, such as the random forest, the decision tree, the support vector machine, and the naïve Bayes algorithms, which we compared in our previous work on the same datasets. The best performing classification models, using the XGBoost algorithm, achieved 91.9% detection accuracy and 98.2% sensitivity, 0.853 AUC, and 0.949 F1 score on the static analysis dataset, and 96.4% accuracy and 98.5% sensitivity, 0.940 AUC, and 0.977 F1 score on the dynamic analysis dataset. Then, we exported the best performing machine learning models and used them in our proposed MLMD program, automating the process of static and dynamic analysis and allowing the trained models to be used for classification on new samples.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Software Testing and Debugging Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computers and Informatics, Faculty of Electrical Engineering and Informatics, Technical University of Košice, Letná 9, 042 00 Kosice, Slovakia
References (33)
Show source-provided references
1. Monnappa, K. (2018). Learning Malware Analysis, Packt Publishing. [1st ed.]. Chapter 1.
2. (2022, March 28). 2020 State of Malware Report. Available online: https://www.malwarebytes.com/resources/files/2020/02/2020_state-of-malware-report.pdf.
3. Elisan, C. (2012). Malware, Rootkits & Botnets A Beginner’s Guide, McGraw-Hill Education. [1st ed.]. Chapter 1.
4. Ławrynowicz, A., and Tresp, V. (2014). Introducing Machine Learning. Perspectives on Ontology Learning, Microsoft Press.
5. (2022, June 10). Deep Instinct Website. Available online: https://www.deepinstinct.com.
6. Mohanta, A., and Saldanha, A. (2020). Malware Analysis and Detection Engineering: A Comprehensive Approach to Detect and Analyze Modern Malware, Apress. [1st ed.].10.1007/978-1-4842-6193-4 ↗
7. Fundamentals of static malware analysis: Principles, methods, and tools
8. Behavior-based features model for malware detection
9. A comparison of static, dynamic, and hybrid analysis for malware detection10.1007/s11416-015-0261-z ↗
10. Heuristic scanning and sandbox approach in malware detection
11. (2022, March 28). Advanced Heuristics to Detect Zero-Day Attacks. Available online: https://hackernoon.com/advanced-heuristics-to-detect-zero-day-attacks-8e3335lt.
12. The rise of machine learning for detection and classification of malware: Research developments, trends and challenges10.1016/j.jnca.2019.102526 ↗
13. Senanayake, J., Kalutarage, H., and Al-Kadri, M.O. (2021). Android Mobile Malware Detection Using Machine Learning: A Systematic Review. Electronics, 10.10.3390/electronics10131606 ↗
14. Schultz, G.M., Eskin, E., Zadok, F., and Stolfo, J.S. (2001, January 13–16). Data Mining Methods for Detection of New Malicious Executables. Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy, Oakland, CA, USA.
15. A Malware Detection Scheme Based on Mining Format Information10.1155/2014/260905 ↗
16. A learning model to detect maliciousness of portable executable using integrated feature set
17. Bragen, R.S. (2015). Malware Detection Through Opcode Sequence Analysis Using Machine Learning. [Master’s Thesis, Gjøvik University College].
18. Chowdhury, M., Rahman, A., and Islam, M. (2017, January 18–20). Protecting data from malware threats using machine learning technique. Proceedings of the 2017 12th IEEE Conference on Industrial Electronics and Applications (ICIEA), Siem Reap, Cambodia.10.1109/ICIEA.2017.8283111 ↗
19. Moser, A., Kruegel, C., and Kirda, E. (2007, January 10–14). Limits of Static Analysis for Malware Detection. Proceedings of the Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007), Miami Beach, FL, USA.10.1109/ACSAC.2007.21 ↗
20. Integrated Static and Dynamic Analysis for Malware Detection10.1016/j.procs.2015.02.149 ↗
21. Firdausi, I., Lim, C., Erwin, A., and Nugroho, A.S. (2010, January 2–3). Analysis of machine learning techniques used in behavior-based malware detec. Proceedings of the 2010 Second International Conference on Advances in Computing, Control, and Telecommunication Technologies, Jakarta, Indonesia.10.1109/ACT.2010.33 ↗
22. Mosli, R., Yuan, B., Li, R., and Pan, Y. (February, January 30). A Behavior-Based Approach for Malware Detection. Proceedings of the 13th IFIP International Conference on Digital Forensics (DigitalForensics), Orlando, FL, USA.
23. Malware classification using XGboost-Gradient Boosted Decision Tree10.25046/aj050566 ↗
24. Malware Detection using Machine Learning Classification Algorithms
25. The Use of Machine Learning Techniques to Advance the Detection and Classification of Unknown Malware10.1016/j.procs.2020.03.110 ↗
26. (2022, March 29). VirusShare Malware Repository. Available online: https://virusshare.com/.
27. (2022, March 29). The Portable Freeware Collection. Available online: https://www.portablefreeware.com/.
28. (2022, March 29). Portable Software Repository. Available online: https://portableapps.com/.
29. (2022, March 29). Dependency Walker Website. Available online: https://www.dependencywalker.com/.
30. (2022, March 29). Cuckoo Sandbox Website. Available online: https://cuckoosandbox.org/.
31. A Review on Evaluation Metrics for Data Classification Evaluations10.5121/ijdkp.2015.5201 ↗
32. Sutorčík, K. (2021). Detection of Malware Samples Using Machine Learning Algorithms and Methods of Dynamic Analysis (In Orig Lang: Využitie Algoritmov StrojovéHo UčEnia na Detekciu MalvéRovýCh Vzoriek Pomocou MetóD Dynamickej Analýzy). [Master’s Thesis, Technická Univerzita v Košiciach].
33. Špakovský, E. (2021). Detection of Malware Samples Using Machine Learning Algorithms and Methods of Static Analysis (In Orig Lang: Využitie Algoritmov StrojovéHo UčEnia na Detekciu MalvéRovýCh Vzoriek Pomocou MetóD Statickej Analýzy). [Master’s Thesis, Technická Univerzita v Košiciach].