A Kullback-Liebler divergence-based representation algorithm for malware detection.

Area of Science:

• Cybersecurity
• Machine Learning
• Software Engineering

Background:

• Malware poses a significant threat to digital security, with sophisticated evasion techniques blurring the lines between malicious and legitimate software behaviors.
• Conventional cybersecurity solutions struggle to accurately differentiate between malicious and benign activities due to overlapping behavioral patterns.

Purpose of the Study:

• To propose a novel algorithm for improved malware behavior characterization and classification.
• To address the limitations of traditional feature representation methods like TF-IDF in accurately weighting malware-specific features.

Main Methods:

• Developed a Kullback-Liebler Divergence-based Term Frequency-Probability Class Distribution (KLD-based TF-PCD) algorithm.
• The algorithm represents features based on the divergence of their probability distributions between malware and benign classes.
• Utilized Kullback-Liebler Divergence to enhance the weighting of significant features, distinguishing malicious from benign software.

Main Results:

• The KLD-based TF-PCD algorithm achieved high performance metrics: 0.972 accuracy, 0.037 false positive rate, and 0.978 F-measure.
• These results demonstrate significant improvement over existing related work in malware classification.
• The proposed method effectively enhances the ability of classifiers to accurately identify malicious behaviors.

Conclusions:

• The KLD-based TF-PCD algorithm offers a more effective approach to malware classification by introducing meaningful characteristics.
• This advancement contributes to strengthening cyberspace security by improving the accuracy of malicious behavior detection.