The increasing adoption of macOS devices leads to a rise in malware targeting the platform, while the current research state of macOS malware detection remains limited compared to Windows. This study aims to enhance macOS malware detection using supervised machine learning techniques. Unlike previous studies, this study integrates multiple feature selection methods, applies nested cross-validation, and introduces a novel RGB image conversion of structured features combined with CycleGAN-generated data for Convolutional Neural Network (CNN) training. The CyberScienceLab macOS malware dataset is used, where comprehensive data preprocessing, feature selection, and balancing through SMOTE are applied to train five supervised machine learning models: Support Vector Machine (SVM), Decision Tree, Naïve Bayes, Random Forest and Logistic Regression. Each model undergoes nested cross-validation and hyperparameter tuning to ensure robust evaluation. For CNN training, RGB images are generated by transforming structural static feature vectors. CycleGAN is employed to generate synthetic image data to address the small dataset size. The results show that all supervised learning models outperform previous studies using the same dataset, with SVM achieving the highest accuracy of 98.88% and CNN achieving 96.21%. These findings highlight that a well-designed machine learning workflow with structured data can outperform CNN-based models in this context, although deep learning remains a competitive approach. Future work focuses on expanding the dataset with more recent malware samples and exploring alternative generative methods to further improve performance.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Machine Learning-Based Malware Detection on macOS

  • Adrian Guo Xiang Low,
  • Leonardo Aniello

摘要

The increasing adoption of macOS devices leads to a rise in malware targeting the platform, while the current research state of macOS malware detection remains limited compared to Windows. This study aims to enhance macOS malware detection using supervised machine learning techniques. Unlike previous studies, this study integrates multiple feature selection methods, applies nested cross-validation, and introduces a novel RGB image conversion of structured features combined with CycleGAN-generated data for Convolutional Neural Network (CNN) training. The CyberScienceLab macOS malware dataset is used, where comprehensive data preprocessing, feature selection, and balancing through SMOTE are applied to train five supervised machine learning models: Support Vector Machine (SVM), Decision Tree, Naïve Bayes, Random Forest and Logistic Regression. Each model undergoes nested cross-validation and hyperparameter tuning to ensure robust evaluation. For CNN training, RGB images are generated by transforming structural static feature vectors. CycleGAN is employed to generate synthetic image data to address the small dataset size. The results show that all supervised learning models outperform previous studies using the same dataset, with SVM achieving the highest accuracy of 98.88% and CNN achieving 96.21%. These findings highlight that a well-designed machine learning workflow with structured data can outperform CNN-based models in this context, although deep learning remains a competitive approach. Future work focuses on expanding the dataset with more recent malware samples and exploring alternative generative methods to further improve performance.