A malware detection scheme based on mining format information.

Area of Science:

• Computer Science
• Cybersecurity
• Information Technology

Background:

• Malware poses a significant threat to computer systems.
• Current malware detection technologies have notable limitations.
• Effective detection of new and unknown malware is crucial.

Purpose of the Study:

• To propose a novel malware detection approach.
• To leverage Portable Executable (PE) file format information for enhanced detection.
• To evaluate the performance and detection capabilities for new malware variants.

Main Methods:

• In-depth analysis of static format information within PE files.
• Extraction of 197 features from PE file format data.
• Application of feature selection techniques for dimensionality reduction.
• Training and evaluation using classification algorithms.

Main Results:

• Achieved a top classification accuracy of 99.1% with an AUC of 0.998.
• Successfully identified 97.6% of new malware samples.
• Maintained a low false positive rate of 1.3% for new malware detection.

Conclusions:

• The proposed method effectively utilizes PE file format information for malware detection.
• The approach demonstrates high performance in identifying known and unknown malware.
• This technique offers a promising solution to overcome limitations in current malware detection systems.