
Detection and mitigation of modern malware are critical for the normal operation of an organisation. Traditional defence mechanisms are becoming increasingly ineffective due to the techniques used by attackers such as code obfuscation, metamorphism, and polymorphism, which strengthen the resilience of malware. In this context, the development of adaptive, more effective malware detection methods has been identified as an urgent requirement for protecting the IT infrastructure against such threats, and for ensuring security. In this paper, we investigate an alternative method for malware detection that is based on N-grams and machine learning. We use a dynamic analysis technique to extract an Indicator of Compromise (IOC) for malicious files, which are represented using N-grams. The paper also proposes TF-IDF as a novel alternative used to identify the most significant N-grams features for training a machine learning algorithm. Finally, the paper evaluates the proposed technique using various supervised machine-learning algorithms. The results show that Logistic Regression, with a score of 98.4%, provides the best classification accuracy when compared to the other classifiers used.
Random Forests, /dk/atira/pure/subjectarea/asjc/2200/2207, Sandbox, Computer Networks and Communications, /dk/atira/pure/subjectarea/asjc/2200/2208, Decision Tree, Malware, Naive Bayes, Machine learning, Dynamic analysis, Logistic Regression, Electrical and Electronic Engineering, API call, /dk/atira/pure/subjectarea/asjc/1700/1711, sandbox, /dk/atira/pure/subjectarea/asjc/1700/1705, malware, /dk/atira/pure/subjectarea/asjc/1700/1708, dynamic analysis, SNDBOX, machine learning, Control and Systems Engineering, Hardware and Architecture, Signal Processing, N-grams
Random Forests, /dk/atira/pure/subjectarea/asjc/2200/2207, Sandbox, Computer Networks and Communications, /dk/atira/pure/subjectarea/asjc/2200/2208, Decision Tree, Malware, Naive Bayes, Machine learning, Dynamic analysis, Logistic Regression, Electrical and Electronic Engineering, API call, /dk/atira/pure/subjectarea/asjc/1700/1711, sandbox, /dk/atira/pure/subjectarea/asjc/1700/1705, malware, /dk/atira/pure/subjectarea/asjc/1700/1708, dynamic analysis, SNDBOX, machine learning, Control and Systems Engineering, Hardware and Architecture, Signal Processing, N-grams
| selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | 59 | |
| popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network. | Top 1% | |
| influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | Top 10% | |
| impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network. | Top 1% |
