Abstract
Combating malware is very important for software/systems security, but to prevent the software/systems from the advanced malware, viz. metamorphic malware is a challenging task, as it changes the structure/code after each infection. Therefore in this paper, we present a novel approach to detect the advanced malware with high accuracy by analyzing the occurrence of opcodes (features) by grouping the executables. These groups are made on the basis of our earlier studies [1] that the difference between the sizes of any two malware generated by popular advanced malware kits viz. PS-MPC, G2 and NGVCK are within 5 KB. On the basis of obtained promising features, we studied the performance of thirteen classifiers using N-fold cross-validation available in machine learning tool WEKA. Among these thirteen classifiers we studied in-depth top five classifiers (Random forest, LMT, NBT, J48 and FT) and obtain more than 96.28% accuracy for the detection of unknown malware, which is better than the maximum detection accuracy (95.9%) reported by Santos et al (2013). In these top five classifiers, our approach obtained a detection accuracy of 97.95% by the Random forest.
Abstract (translated by Google)
防范恶意软件对于软件/系统安全非常重要，但要防止软件/系统受到高级恶意软件的攻击，即。变形恶意软件是一项具有挑战性的任务，因为它会在每次感染后更改结构/代码。因此，在本文中，我们提出了一种新方法，通过对可执行文件进行分组来分析操作码（特征）的出现，从而高精度地检测高级恶意软件。这些小组是在我们早期研究[1]的基础上制作的，即流行的高级恶意软件包生成的任何两种恶意软件的大小之间的差异即。 PS-MPC，G2和NGVCK均在5 KB范围内。在获得有希望的特征的基础上，我们使用机器学习工具WEKA中可用的N折叠交叉验证研究了13个分类器的性能。在这13个分类器中，我们深入研究了前五种分类器（随机森林，LMT，NBT，J48和FT），并获得了超过96.28％的未知恶意软件检测准确率，优于最大检测精度（95.9％）由Santos等人（2013）报道。在这五大分类器中，我们的方法通过随机森林获得了97.95％的检测准确度。
URL
http://arxiv.org/abs/1606.06897