Parameter Optimization of Classification Techniques for PDF based Malware Detection

Embedding malicious codes in Portable Document Format (PDF) files has been one of the prime a venues i n a never-ending cat and mouse game between malware authors and malware analysts in past decade. By planting such malicious files in a victim machine by any means, e.g., email attachments, adversaries pose severe damage from personal assets to large business network infrastructure. To combat this menace, academic and industry based security researchers have been carrying out machine learning based techniques to discover novel types of PDF based malware. In our study, we examine state-of-the-art classification techniques that have been previously experimented in this active area of research to empirically derive the optimal parameter settings of such highly configurable algorithms. We investigate, 20 classifiers derived from 9 machine learning families on a large dataset. To evaluate our models’ performances, we report precision, recall, and F
1
scores along with accuracy and provide a comparison chart to show how each family stands up to the expectation. We observe, 16 out of 20 studied classifiers achieve better results compared to its respective default configuration. As parameter optimization problem is very less talked about in this application domain, we are optimistic that our detailed experimental analysis will help select the optimal settings of a classifier from the studied machine learning algorithm suite.