Comparison of Feature Extraction and Classification Techniques of PE Malware

Abstract

Static and dynamic analysis are widely used in malware research. Although both approaches present considerable advantages according to their specific applications, they also present some challenges in terms of the time and resources constraints when extracting features. To alleviate those constraints, recent research works explore the use of techniques such as computer vision, in detecting malicious samples and their corresponding malware family. In this research, we aim to conduct a thorough comparison between a combination set of different feature extraction and classification techniques in order to identify the optimal approach that can be used in a real-time malware detection application portable executable (PE). Multiple Machine Learning (ML) and Deep Learning (DL) algorithms were used with image-based features and non image-based features. The results obtained show high performance when using static PE header features with K-Nearest Neighbor (KNN) and Bagged Trees algorithms for bi-level classification and Image-based Fast Fourier Transform (FFT) features with AlexNet for multi-level classification.