Malware-Detection Model Using Learning-Based Discovery of Static Features

The proliferation of malware poses a severe threat to enterprises and individuals. Therefore, there has been a spurt in the studies related to discovering learning-based malware-detection methods. The previous studies are mostly concentrated on the performance of learning model, while our targets are two folds: optimizing the machine-learning model, and exploring the application of finalized learning model to malware activities. We adopt optimizing methods for the machine-learning workflow, which includes noise reduction, initial triage, feature engineering, and ensemble learning. We train two different malware-detection models for packed and non-packed executable datasets through the learning stage. Besides experimental validation of the superior performance of the proposed optimizing methods, we analyzed the results by comparative analyses. The performance was measured using three evaluation metrics: the receiver operating characteristic curve, the classification accuracy, and the classification report. When the variance threshold was used along with the random forest algorithm, we obtained the best performance for non-packed malware detection, whereas when feature importance was used along with the random forest algorithm, we obtained the best performance for packed malware detection. The finalized models were implemented in the detection stage.