This work presents a static malware detection system using seven different classifiers: K-Nearest Neighbors (KNN), Naïve Bayes, Random Forest, Decision Trees, Logistic Regression, Gradient Boosting, and Artificial Neural Networks (ANN). The system focuses on five essential features: hash, size of data, virtual address, virtual size, and entropy, extracted from the Portable Executable (PE) Section Headers of the.text and.code sections. A dataset of 41,568 malicious and 1,725 benign PE files, curated from Cuckoo Sandbox reports, was used for classification. This dataset comprises six columns and 43,293 rows, providing a robust foundation for analysis and classification. The experimental results revealed that leveraging only these five features led to an impressive accuracy of 98.70% with the Random Forest classifier, underscoring the effectiveness of these minimal features in malware detection and the potential for creating efficient detection systems with fewer attributes.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

PE Static Malware Analysis with Minimal Features

  • Mehdi Kmiti,
  • Khalid El Gholami,
  • Yassine Maleh

摘要

This work presents a static malware detection system using seven different classifiers: K-Nearest Neighbors (KNN), Naïve Bayes, Random Forest, Decision Trees, Logistic Regression, Gradient Boosting, and Artificial Neural Networks (ANN). The system focuses on five essential features: hash, size of data, virtual address, virtual size, and entropy, extracted from the Portable Executable (PE) Section Headers of the.text and.code sections. A dataset of 41,568 malicious and 1,725 benign PE files, curated from Cuckoo Sandbox reports, was used for classification. This dataset comprises six columns and 43,293 rows, providing a robust foundation for analysis and classification. The experimental results revealed that leveraging only these five features led to an impressive accuracy of 98.70% with the Random Forest classifier, underscoring the effectiveness of these minimal features in malware detection and the potential for creating efficient detection systems with fewer attributes.