Windows malware detection based on static analysis with multiple features.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Malware poses a significant and persistent threat to computer systems and users.
• Existing malware detection methods often struggle with accuracy and efficiency.
• The research community continuously seeks improved techniques for robust malware identification.

Purpose of the Study:

• To develop and evaluate a high-accuracy static malware detection system for Windows Portable Executable (PE) files.
• To explore the effectiveness of various machine learning and ensemble learning techniques in malware classification.
• To enhance detection performance through dimensionality reduction methods.

Main Methods:

• A dataset of 27,920 Windows PE malware samples was created, extracting features from PE Headers, PE Sections, imported DLLs, and API functions.
• Seven machine learning models (Gradient Boosting, Decision Tree, Random Forest, SVM, KNN, Naive Bayes, Nearest Centroid) and three ensemble techniques (Majority Voting, Stack Generalization, AdaBoost) were applied.
• Dimensionality reduction techniques, Information Gain and Principal Component Analysis, were employed to optimize feature sets.

Main Results:

• The static malware detection system achieved a high detection rate of 99.5%.
• The system demonstrated a low error rate of 0.47%.
• Experiments confirmed the system's superior performance and robustness on both raw and reduced feature sets compared to prior studies.

Conclusions:

• The integrated approach combining machine learning, ensemble learning, and dimensionality reduction effectively detects Windows PE malware.
• The developed system offers a highly accurate and efficient solution for static malware analysis.
• This research contributes a robust framework for improving cybersecurity defenses against malicious software.