Supervised and Unsupervised Learning Techniques for Malware Classification Based on Opcode Frequency Features
摘要
Over the years, the complexity of malware has increased, presenting a significant threat to existing security systems. Malware, or malicious software, is designed to disrupt computer systems intentionally. The sophistication of malware has heightened, rendering it more challenging to detect. Notably, malware and benign files utilize opcodes differently, leading to variations in opcode usage frequencies. Malware files more frequently invoke some opcodes than benign files, while others see more significant usage in benign files than malware files. Leveraging these discrepancies in opcode usage frequencies enables the differentiation between malware and benign files. This paper investigates the use of supervised and unsupervised algorithms, emphasizing opcode frequency analysis. Here, we have utilized machine learning algorithms such as random forest, AdaBoost, decision tree, support vector machine (SVM), stacking classifier, and autoencoder. All these algorithms have demonstrated commendable performance. The stacking classifier had the highest performance, achieving an F1 score exceeding 99.6% for Dataset I and 99.3% for Dataset II. The autoencoder yielded an F1 score of approximately 96%. Furthermore, we employ SHAP to generate model explanations, providing insight into the interpretability of our models.