Dynamic Malware Classification and API Categorisation of Windows Portable Executable Files Using Machine Learning
Source abstract
Abstract
The rise of malware attacks presents a significant cyber-security challenge, with advanced techniques and offline command-and-control (C2) servers causing disruptions and financial losses. This paper proposes a methodology for dynamic malware analysis and classification using a malware Portable Executable (PE) file from the MalwareBazaar repository. It suggests effective strategies to mitigate the impact of evolving malware threats. For this purpose, a five-level approach for data management and experiments was utilised: (1) generation of a customised dataset by analysing a total of 582 malware and 438 goodware samples from Windows PE files; (2) feature extraction and feature scoring based on Chi2 and Gini importance; (3) empirical evaluation of six state-of-the-art baseline machine learning (ML) models, including Logistic Regression (LR), Support Vector Machine (SVM), Naive Bayes (NB), Random Forest (RF), XGBoost (XGB), and K-Nearest Neighbour (KNN), with the curated dataset; (4) malware family classification using VirusTotal APIs; and, finally, (5) categorisation of 23 distinct APIs from 266 malware APIs. According to the results, Gini’s method takes a holistic view of feature scoring, considering a wider range of API activities. The RF achieved the highest precision of 0.99, accuracy of 0.96, area under the curve (AUC) of 0.98, and F1-score of 0.96, with a 0.93 true-positive rate (TPR) and 0.0098 false-positive rate (FPR), among all applied ML models. The results show that Trojans (27%) and ransomware (22%) are the most risky among 11 malware families. Windows-based APIs (22%), the file system (12%), and registry manipulation (8.2%) showcased their importance in detecting malicious activity in API categorisation. This paper considers a dual approach for feature reduction and scoring, resulting in an improved F1-score (2%), and the inclusion of AUC and specificity metrics distinguishes it from existing research (Section Comparative Analysis with Existing Approaches). The newly generated dataset is publicly available in the GitHub repository (Data Availability Statement) to facilitate aspirant researchers’ dynamic malware analysis.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Digital and Cyber Forensics
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Computer Science, University of Galway, H91 TK33 Galway, Ireland
Funding
School of Computer Science, University of Galway, Ireland
References (53)
Show source-provided references
1. Xhafa, F. (2022). Autonomous and Connected Heavy Vehicle Technology, Academic Press.
2. Basyurt, A.S., Fromm, J., Kuehn, P., Kaufhold, M.A., and Mirbabaie, M. (2022, January 21–23). Help Wanted—Challenges in Data Collection, Analysis and Communication of Cyber Threats in Security Operation Centers. Proceedings of the 17th International Conference on Wirtschaftsinformatik 2022, Nuremberg, Germany.
3. The rise of machine learning for detection and classification of malware: Research developments, trends and challenges10.1016/j.jnca.2019.102526 ↗
4. (2023, June 12). Global Ransomware Damage Costs. Available online: https://cybersecurityventures.com/global-ransomware-damage-costs-predicted-to-reach-250-billion-usd-by-2031/.
5. (2023, June 12). A.T. ATLAS Malware & PUA. Available online: https://portal.av-atlas.org/malware/.
6. Digital twin: A comprehensive survey of security threats10.1109/COMST.2022.3171465 ↗
7. Azshwanth, D., and Ponsam, J.G. (2022, January 15–16). A novel approach to detect malware in portable executables of major operating systems. Proceedings of the 2022 International Conference on Innovative Computing, Intelligent Communication and Smart Electrical Systems (ICSES), Chennai, India.10.1109/ICSES55317.2022.9914382 ↗
8. A malicious mining code detection method based on multi-features fusion10.1109/TNSE.2022.3155187 ↗
9. Malware and malware detection techniques: A survey
10. Evaluation of deep learning methods efficiency for malicious and benign system calls classification on the AWSCTD
11. A multi-dimensional machine learning approach to predict advanced malware10.1016/j.comnet.2019.06.015 ↗
12. Kim, G., Yi, H., Lee, J., Paek, Y., and Yoon, S. (2016). LSTM-based system-call language modeling and robust ensemble method for designing host-based intrusion detection systems. arXiv.
13. Yazi, A.F., Çatak, F.Ö., and Gül, E. (2019, January 24–26). Classification of methamorphic malware with deep learning (LSTM). Proceedings of the 2019 27th Signal Processing and Communications Applications Conference (SIU), Sivas, Turkey.10.1109/SIU.2019.8806571 ↗
14. Catak, F.O., and Yazı, A.F. (2019). A benchmark API call dataset for windows PE malware classification. arXiv.
15. A dynamic Windows malware detection and prediction method based on contextual understanding of API call sequence10.1016/j.cose.2020.101760 ↗
16. A feature extraction method of hybrid gram for malicious behavior based on machine learning10.1155/2019/2674684 ↗
17. Metamorphic malicious code behavior detection using probabilistic inference methods10.1016/j.cogsys.2019.03.007 ↗
18. Tajoddin, A., and Jalili, S. (2018). HM 3 alD: Polymorphic Malware detection using program behavior-aware hidden Markov model. Appl. Sci., 8.10.3390/app8071044 ↗
19. Efficient dynamic malware analysis using virtual time control mechanics10.1016/j.cose.2017.11.010 ↗
20. Malware classification based on API calls and behaviour analysis10.1049/iet-ifs.2017.0430 ↗
21. Improving malware detection by applying multi-inducer ensemble10.1016/j.csda.2008.10.015 ↗
22. Qiao, Y., Yang, Y., He, J., Tang, C., and Liu, Z. (2014). Knowledge Engineering and Management: Proceedings of the Seventh International Conference on Intelligent Systems and Knowledge Engineering, Beijing, China, December 2012 (ISKE 2012), Springer.
23. Sethi, K., Chaudhary, S.K., Tripathy, B.K., and Bera, P. (2018, January 4–7). A novel malware analysis framework for malware detection and classification using machine learning approach. Proceedings of the 19th International Conference on Distributed Computing and Networking, Varanasi, India.10.1145/3154273.3154326 ↗
24. Qiao, Y., Yang, Y., Ji, L., and He, J. (2013, January 16–18). Analyzing malware by abstracting the frequent itemsets in API call sequences. Proceedings of the 2013 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, Melbourne, VIC, Australia.10.1109/TrustCom.2013.36 ↗
25. Imbalanced Malware Family Classification Using Multimodal Fusion and Weight Self-Learning10.1109/TITS.2022.3208891 ↗
26. Hansen, S.S., Larsen, T.M.T., Stevanovic, M., and Pedersen, J.M. (2016, January 15–18). An approach for detection and family classification of malware based on behavioral analysis. Proceedings of the 2016 International Conference on Computing, Networking and Communications (ICNC), Kauai, HI, USA.10.1109/ICCNC.2016.7440587 ↗
27. Daeef, A.Y., Al-Naji, A., and Chahl, J. (2022). Features Engineering for Malware Family Classification Based API Call. Computers, 11.10.3390/computers11110160 ↗
28. A survey on machine learning-based malware detection in executable files10.1016/j.sysarc.2020.101861 ↗
29. An Attribute Extraction for Automated Malware Attack Classification and Detection Using Soft Computing Techniques10.1155/2022/5061059 ↗
30. Vadrevu, P., Rahbarinia, B., Perdisci, R., Li, K., and Antonakakis, M. (2013, January 9–13). Measuring and detecting malware downloads in live network traffic. Proceedings of the Computer Security—ESORICS 2013: 18th European Symposium on Research in Computer Security, Egham, UK. Proceedings 18.10.1007/978-3-642-40203-6_31 ↗
31. Mills, A., Spyridopoulos, T., and Legg, P. (2019, January 3–4). Efficient and interpretable real-time malware detection using random-forest. Proceedings of the 2019 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (Cyber SA), Oxford, UK.10.1109/CyberSA.2019.8899533 ↗
32. Uppal, D., Sinha, R., Mehra, V., and Jain, V. (2014, January 24–27). Malware detection and classification based on extraction of API sequences. Proceedings of the 2014 International Conference on Advances in Computing, Communications and Informatics (ICACCI), Delhi, India.10.1109/ICACCI.2014.6968547 ↗
33. Kwon, B.J., Mondal, J., Jang, J., Bilge, L., and Dumitraş, T. (2015, January 12–16). The dropper effect: Insights into malware distribution with downloader graph analytics. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, Denver, CO, USA.10.1145/2810103.2813724 ↗
34. Mao, W., Cai, Z., Towsley, D., and Guan, X. (2015). Proceedings of the Research in Attacks, Intrusions, and Defenses: 18th International Symposium, RAID 2015, Kyoto, Japan, 2–4 November 2015, Springer. Proceedings 18.
35. Wüchner, T., Ochoa, M., and Pretschner, A. (2015, January 9–10). Robust and effective malware detection through quantitative data flow graph metrics. Proceedings of the Detection of Intrusions and Malware, and Vulnerability Assessment: 12th International Conference, DIMVA 2015, Milan, Italy. Proceedings 12.10.1007/978-3-319-20550-2_6 ↗
36. Ahmadi, M., Ulyanov, D., Semenov, S., Trofimov, M., and Giacinto, G. (2016, January 9–11). Novel feature extraction, selection and fusion for effective malware family classification. Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy, New Orleans, LO, USA.10.1145/2857705.2857713 ↗
37. An ensemble-based malware detection model using minimum feature set
38. Dener, M., Ok, G., and Orman, A. (2022). Malware detection using memory analysis data in big data environment. Appl. Sci., 12.10.3390/app12178604 ↗
39. Azmee, A., Choudhury, P.P., Alam, M.A., and Dutta, O. (2019). Performance Analysis of Machine Learning Classifiers for Detecting PE Malware. [Ph.D. Thesis, Brac University].10.14569/IJACSA.2020.0110163 ↗
40. API call-based malware classification using recurrent neural networks
41. Eskandari, M., Khorshidpur, Z., and Hashemi, S. (2012, January 22–24). To incorporate sequential dynamic features in malware detection engines. Proceedings of the 2012 European Intelligence and Security Informatics Conference, Odense, Denmark.10.1109/EISIC.2012.57 ↗
42. Oliveira, A., and Sassi, R. (2019). Behavioral malware detection using deep graph convolutional neural networks. TechRxiv, preprint.
43. Dynamic API call sequence visualisation for malware classification10.1049/iet-ifs.2018.5268 ↗
44. Fujino, A., Murakami, J., and Mori, T. (2015, January 9–12). Discovering similar malware samples using API call topics. Proceedings of the 2015 12th Annual IEEE Consumer Communications and Networking Conference (CCNC), Las Vegas, NV, USA.10.1109/CCNC.2015.7157960 ↗
45. David, O.E., and Netanyahu, N.S. (2015, January 12–17). Deepsign: Deep learning for automatic malware signature generation and classification. Proceedings of the 2015 International Joint Conference on Neural Networks (IJCNN), Killarney, Ireland.10.1109/IJCNN.2015.7280815 ↗
46. MAAR: Robust features to detect malicious activity based on API calls, their arguments and return values10.1016/j.engappai.2016.12.016 ↗
47. (2023, December 03). Malwarebazar Dataset. Available online: https://bazaar.abuse.ch/.
48. (2023, April 20). Goodware Git Repository. Available online: https://github.com/iosifache/DikeDataset/tree/main/files/benign//.
49. (2023, May 04). Cuckoo Sandbox. Available online: https://cuckoo.readthedocs.io/en/latest/.
50. Improving file-level fuzzy hashes for malware variant classification10.1016/j.diin.2019.01.018 ↗
51. (2023, March 27). VirusTotal API. Available online: https://www.virustotal.com/gui/home/upload.
52. Deep learning based Sequential model for malware analysis using Windows exe API Calls10.7717/peerj-cs.285 ↗
53. A distributed deep learning system for web attack detection on edge devices10.1109/TII.2019.2938778 ↗