Assessment of supervised machine learning algorithms using dynamic API calls for malware detection

ABSTRACT

Detection of malware using traditional malware detection techniques is very hard. Machine Learning (ML) algorithms provide a solution to detect the malware which is being developed at a very high pace. ML automatic anti-malware system can be developed which can update the system with incoming malware to keep the system secure. To train the malware classifiers runtime features are captured through Cuckoo Sandbox. During execution, malware can drop other malicious payloads and every payload performs different malicious activities. API calls of every process executed by malware or benign file are extracted. In this paper, parameter tuning of Machine Learning (ML) is done to produce the high accuracy results in a binary classification of binary files into malware or benign. In machine learning algorithms, a few essential parameters like k value, kernel function, depth of the tree, loss function, splitting criteria, learning rate, and n-estimators are evaluated using API calls for achieving the high accurate results of the malware classifiers. At last, supervised machine learning classification algorithms were assessed with 6434 benign and 8634 malware samples. Malware classifier produced 99.1% accuracy using ensemble algorithms. This paper provides insight into the parameter tuning of ML algorithms for detecting the malware using API calls.

KEYWORDS:

• Malware
• dynamic analysis
• API calls
• machine learning algorithms
• classification

Disclosure statement

No potential conflict of interest was reported by the author(s).

Additional information

Notes on contributors

Jagsir Singh

Jagsir Singh is a Ph.D. Research Scholar in the department of Computer Science and Engineering at the Punjabi University Patiala, India. He did B.Tech. in Computer Science and Engineering from Punjabi University, Patiala in 2014. He did M.Tech. in Information Technology form UIET, Panjab University, Chandigarh, India in 2016. His areas of interest include Information and Network security, Malware Analysis, Cognitive Radio and Machine Learning.

Jaswinder Singh

Dr. Jaswinder Singh is an Associate Professor in the department of Computer Science and Engineering, Punjabi University, Patiala. He did Ph.D. in Computer Engineering from Punjabi University, Patiala, India. He possesses 16 years of teaching experience. His work is published and cited in highly reputed journals of Elsevier, Springer, Taylor and Francis and IEEE. His areas of interest include Network Security, Malware Analysis, Machine Learning and Cloud Computing.