Analysis of machine learning models for malware detection

Abstract

With the increasing importance of the internet and computers in the modern world, the task of its maintenance and protection from the threats posed by malicious software has become incredibly important. Malwares interfere with the regular working operations of other files and are responsible for corruption and leakage of private data to the outside world. The overall purpose of this research was to handle this exponentially growing threat to information technology and find a robust machine learning model required for the correct detection of malware. A more efficient and real-time working model is required for detection. The aim of this paper is to provide a concise analysis of malware detection methods using machine learning (ML) models having high detection rates, that have been proposed for the past few years. As the result of our analysis we found that the detection techniques can be divided into three sections on the basis of analysis carried out for feature study viz. Static, Dynamic and Hybrid. Classification algorithms such as Support Vector Machine (SVM), K-Nearest Neighbor (KNN), Random Forest (RF), Decision Trees (DT), Naïve Bayes (NB), Neural Networks (NN), and many others were used for classification purpose. Some of the ML models have also combined big data, data mining and deep learning algorithms to achieve high accuracy rates. We concluded that ML methods have proven to give better results than the old signature-based or heuristics-based detection techniques and have high possibilities of further development.

Subject Classification:

• 68U99

Keywords:

• Dynamic Analysis
• Static Analysis
• Sandbox
• PE Header File
• Feature selection
• Deep learning
• Big Data
• Data Mining
• Supervised Learning
• Semi-Supervised Learning
• Unsupervised Learning