Comparing and analysing binary classification algorithms when used to detect the Zeus malware

Abstract

The Zeus banking malware is one of the most prolific banking malware variants ever to be discovered. This paper examines and analyses the Support Vector Machine (SVM), Decision Tree and Random Forest machine learning algorithms when used in conjunction with a manual feature selection process to detect Zeus network traffic. Selecting the features manually provides the researcher with more control over which features that can and should be selected. The manual feature selection process will also allow the researcher to analyze the impact of the various features and then select the features that provide the best accuracy results during the classification and detection of Zeus. The algorithms in scope for this research are the Decision Tree algorithm, Random Forest algorithm and the SVM algorithm.