Review of Machine Learning Methods for Windows Malware Detection

Abstract

Malicious software or malware is one of the most critical cyber threats intentionally designed to cause damage, disrupt and gain unauthorized access to the system. The system can be a computer, server and computer network. Windows operating systems are widely used operating systems. It is easy for hackers to spread malware in these operating systems and exploit its vulnerabilities. Malware detection has always been a challenging issue and major concern for the data privacy. Many signature-based malware detection methods have been presented that work at a certain level and fail to detect unknown malware executable files, therefore the aim is to investigate a novel approach which can detect the new and unseen malware. In this paper, a simple and efficient malware detection model is introduced which distinguish between benign and malicious executable files by extracting features from the PE (portable executable) headers. Different machine learning methods such as Support Vector Machine, Decision Tree, Random Forest and Naive Bays classifiers are used for the classification. Random forest classifier among the different classifiers has achieved the highest accuracy result with the dataset of file, optional and section header.