Machine learning approach for malware multiclass classification

Houssem Hosni (1)

1 Phare

Categorization of modern malware samples on the basis of their behavior has become essential for the computer security community, because they receive huge number of mutated malwares every day, and the signature extraction process is usually based on malicious parts characterizing malware families. Microsoft provided the data science and cybersecurity community with an unprecedented malware dataset of near 0.5 terabytes, containing more than 20K malware samples to encourage open-source progress on effective techniques for grouping variants of malware files into their respective families. In the present paper we develop an effective machine learning approach where emphasis has been given to the phases related to data analysis, feature engineering and modeling. The proposed methodology gave interesting classification results in terms of adopted performance metrics.

Mots clés: Feature engineering; Classification; Computer security; Malware family; random forest; Accuracy; Performance metrics; Xgboost; Windows Malware; KNN; Machine learning

Domaines: Informatique [cs]; Intelligence artificielle [cs.AI]; Cryptographie et sécurité [cs.CR]

Houssem Hosni. Machine learning approach for malware multiclass classification. BRAINS 2019 - 1st Blockchain, Robotics, AI for Networking Security Conference, Mar 2019, Rio de janeiro, Brazil. ⟨hal-02075139⟩